The WP Show Stats plugin for WordPress, developed by Ashish Ajani, contains a CSRF vulnerability (CVE-2025-32678) in versions up to 1.5. This vulnerability enables attackers to induce authenticated users to execute unwanted actions by exploiting the lack of proper request validation. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix details have been provided as of the publication date.

Successful exploitation could allow an attacker to cause an authenticated user to perform unintended actions within the WP Show Stats plugin context, potentially leading to limited integrity impact. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the WP Show Stats plugin or limiting access to trusted users to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.