The vulnerability CVE-2025-28984 is a CSRF issue in the Subscription Renewal Reminders for WooCommerce plugin by storepro, affecting versions up to 1.4.1. It allows attackers to induce authenticated users to submit unauthorized requests, potentially leading to limited impact on the integrity of the system. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires user interaction, but no privileges are needed. Confidentiality and availability are not impacted, only integrity is affected to a low degree.

The impact is limited to a low integrity compromise due to the CSRF vulnerability. An attacker could cause an authenticated user to perform unintended actions related to subscription renewal reminders, but there is no direct impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonce tokens or disabling the plugin if not required. Monitor vendor communications for updates on patches or official mitigations.