The CNZZ&51LA plugin for WordPress, up to version 1.0.1, contains a CSRF vulnerability (CVE-2025-23823) that could allow attackers to execute unauthorized actions by exploiting the trust of authenticated users. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this CSRF vulnerability could lead to unauthorized actions performed with the privileges of an authenticated user, potentially resulting in limited confidentiality, integrity, and availability impacts on the affected WordPress site. The overall severity is high due to the combination of remote exploitability and impact on multiple security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the CNZZ&51LA plugin if possible, or implement CSRF protections such as verifying nonces or tokens in requests. Monitor official sources for updates and patches.