The vulnerability CVE-2025-27003 involves a CSRF issue in the fullworks Quick Paypal Payments plugin, affecting versions up to 5.7.46. The flaw allows attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation mechanisms. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity but not confidentiality or availability.

Successful exploitation could lead to unauthorized actions being performed on behalf of an authenticated user, potentially altering payment-related settings or transactions. However, the impact is limited to integrity with no direct confidentiality or availability consequences reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted contexts. Monitor official fullworks communications for updates on patches or mitigations.