The vulnerability CVE-2025-24714 is a CSRF issue in the Wow-Company Bubble Menu – circle floating menu plugin affecting versions up to 4.0.2. It allows attackers to induce authenticated users to execute unwanted commands by leveraging the lack of proper CSRF protections. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could lead to unauthorized actions performed by authenticated users without their consent, potentially causing limited integrity and availability impacts. There is no confidentiality impact. The medium severity rating reflects these limited but tangible risks. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as tokens or disabling the plugin if feasible. Monitor official Wow-Company communications for updates on fixes.