The vulnerability CVE-2025-47448 is a CSRF issue in the ThimPress WP Hotel Booking plugin (versions <= 2.1.9). It enables attackers to perform unauthorized actions by exploiting the trust a web application has in the user's browser. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity with no confidentiality or availability impact.

The impact is limited to integrity, meaning an attacker could cause unauthorized state changes or actions within the plugin context if a user is tricked into submitting a malicious request. There is no direct confidentiality or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests, and educating users to avoid clicking suspicious links while authenticated. Monitor the vendor's communications for updates on patches or official mitigations.