CVE-2025-46462 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Trân Minh-Quân WPVN plugin, affecting the wpvn-username-changer feature in versions up to 0.7.8. The vulnerability allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized actions. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. There is no vendor advisory or patch information available to confirm remediation status.

The vulnerability could allow an attacker to induce an authenticated user to perform unintended actions within the WPVN plugin, potentially leading to limited integrity impact. Confidentiality and availability impacts are not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting access to trusted users. Monitor official sources for updates regarding patches or official fixes.