The vulnerability CVE-2025-27290 is a CSRF issue in the Erima Zarinpal Donate plugin (version 1.0 and earlier). It allows attackers to induce authenticated users to perform unintended actions without their consent. The vulnerability does not require privileges or elevated access and has a low attack complexity. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits in the wild have been documented, and no patch or remediation details are currently provided.

The impact is limited to potential unauthorized modification of data or actions within the affected plugin due to CSRF. Confidentiality and availability are not affected. The medium severity reflects the potential for integrity compromise without requiring privileges or complex attack conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or disabling the plugin if not in use. Monitor vendor channels for updates regarding patches or official mitigations.