The vulnerability CVE-2025-28902 is a CSRF issue in the Contact Form 7 Select Box Editor Button plugin by Benjamin Pick, affecting versions up to 0.6. It allows attackers to perform unauthorized actions by exploiting the trust of an authenticated user, requiring user interaction. The CVSS score of 4.3 reflects a network attack vector with low complexity and no privileges required, but user interaction is necessary. The impact is limited to integrity with no confidentiality or availability impact reported. No patch or official fix has been documented.

The impact is limited to potential unauthorized actions performed via CSRF, affecting the integrity of the affected plugin's functionality. There is no reported impact on confidentiality or availability. The medium severity score indicates moderate risk but no critical system compromise is expected based on available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonce tokens or disabling the vulnerable plugin if feasible. Monitor vendor communications for updates on patches or official mitigations.