CVE-2025-30923 is a CSRF vulnerability in the powerfulwp Gift Message for WooCommerce plugin affecting versions up to 1.7.8. The vulnerability allows an attacker to induce an authenticated user to perform unintended actions via crafted requests. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or official fix has been disclosed as of the publication date.

The vulnerability could allow an attacker to cause a user to perform unintended actions within the WooCommerce environment where the plugin is installed. The impact is limited to low integrity changes without affecting confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin or restricting access to trusted users only to reduce risk. Monitor official vendor channels for updates or patches addressing this vulnerability.