The vulnerability CVE-2025-28862 is a CSRF issue in the Venugopal Comment Date and Gravatar remover plugin (<= 1.0). It allows attackers to perform unauthorized actions by exploiting the lack of proper request validation mechanisms to confirm user intent. The vulnerability has a CVSS 3.1 base score of 4.3, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker could potentially induce an authenticated user to perform unintended actions on the plugin, leading to low integrity impact. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider disabling or limiting use of the affected plugin to reduce risk.