The vulnerability CVE-2025-28954 affects the wphobby Backwp plugin (versions up to 2.0.2) and is characterized by a Cross-Site Request Forgery (CSRF) that enables path traversal attacks. The CVSS 3.1 score is 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality or integrity impact, but high impact on availability. No known exploits in the wild or patch information is currently available.

The vulnerability allows an attacker to perform CSRF attacks that exploit path traversal, potentially causing denial of service or disruption of availability of the affected system. There is no direct impact on confidentiality or integrity reported. The scope is changed, indicating the attack can affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should exercise caution with this plugin, limit exposure to untrusted users, and monitor for updates from the vendor.