The WP Calais Auto Tagger plugin for WordPress, up to version 2.0, contains a CSRF vulnerability (CVE-2025-32563) that could allow attackers to induce authenticated users to execute unintended actions. The vulnerability is network exploitable without privileges and requires user interaction. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is necessary, and the vulnerability affects confidentiality, integrity, and availability with a scope change.

Successful exploitation of this CSRF vulnerability could lead to unauthorized actions performed with the privileges of an authenticated user, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or data. The exact impact depends on the actions that can be triggered via the plugin but includes the risk of unauthorized changes or disruptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to trusted users only. Implementing standard CSRF protections at the application level may help mitigate risk.