The vulnerability CVE-2025-48303 is a CSRF issue in the Post Type Converter plugin developed by Kevin Langley Jr. It affects versions up to 0.6. The vulnerability allows an attacker to trick an authenticated user into submitting unwanted requests to the plugin, potentially causing unintended changes. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact is limited to integrity with no confidentiality or availability impact reported.

The vulnerability can lead to unauthorized modification of plugin data or settings through forged requests, impacting data integrity. There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild, suggesting limited active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or restricting access to trusted users only. Implementing standard CSRF protections or using security plugins that provide CSRF mitigation may reduce risk.