The vulnerability CVE-2025-30541 concerns a CSRF issue in the OTWthemes Info Boxes Shortcode and Widget plugin, affecting all versions up to 1.15. This flaw enables attackers to perform unauthorized actions by exploiting the trust of an authenticated user through crafted requests. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity with no confidentiality or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The impact is limited to potential unauthorized modification of data or settings within the plugin context due to CSRF. There is no direct confidentiality or availability impact. The medium severity reflects the limited scope and requirement for user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests, restricting plugin usage to trusted users, or disabling the plugin if not essential. Monitor official OTWthemes communications for updates on patches or official fixes.