The vulnerability CVE-2025-25106 is a Cross-Site Request Forgery (CSRF) issue in the FancyWP Starter Templates plugin for WordPress, affecting versions up to 2.0.0. This vulnerability allows an attacker to induce an authenticated user to submit unauthorized requests, potentially leading to full compromise of the plugin's functionality and data. The CVSS 3.1 base score of 9.6 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions with the privileges of an authenticated user, potentially leading to full compromise of the affected plugin's data and functionality. Given the critical CVSS score, the impact includes complete loss of confidentiality, integrity, and availability of the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to trusted users only. Monitor official FancyWP channels for updates and apply patches promptly once available.