The vulnerability CVE-2025-31921 affects the WP Ultimate Tours Builder WordPress plugin (versions up to 1.055) and is classified as a Cross-Site Request Forgery (CSRF) issue. This means that an attacker could cause an authenticated user to perform unintended actions on the site without their consent. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user, potentially altering data or configurations within the WP Ultimate Tours Builder plugin context. The impact is limited to integrity with no confidentiality or availability effects. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the plugin's administrative functions and ensuring users are cautious about clicking untrusted links while authenticated.