The vulnerability CVE-2025-31572 is a CSRF issue in the v20202020 Multi Days Events and Multi Events in One Day Calendar plugin versions up to 1.1.3. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official remediation guidance is currently available.

The impact is limited to integrity, where an attacker could cause a user to perform unintended actions within the affected calendar plugin. There is no impact on confidentiality or availability. The vulnerability requires user interaction and no privileges, making exploitation possible but limited in scope and effect. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as verifying CSRF tokens on state-changing requests or restricting access to trusted users. Monitor official vendor channels for updates.