The vulnerability identified as CVE-2025-32310 affects the QuickCal - Appointment Booking Calendar plugin for WordPress by ThemeMove. It is a Cross-Site Request Forgery (CSRF) issue that enables attackers to escalate privileges by tricking authenticated users into performing unintended actions. The affected versions include all releases up to 1.0.15. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a high level. No patch or vendor advisory has been provided to confirm remediation status.

Successful exploitation of this CSRF vulnerability can lead to privilege escalation within the affected WordPress environment, potentially allowing attackers to modify or control sensitive plugin settings or data. This can compromise the confidentiality, integrity, and availability of the affected system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or limiting the use of the affected plugin to reduce exposure. Implementing standard CSRF protections at the application or web server level may help mitigate risk but are not guaranteed to fully address this specific vulnerability.