The vulnerability CVE-2025-48363 is a CSRF issue in the Popup for CF7 with Sweet Alert WordPress plugin by Metin Saraç. It affects all versions up to 1.6.5 and allows attackers to perform unauthorized actions by exploiting the lack of proper request validation mechanisms. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector with low complexity, no privileges required, and user interaction needed. The impact is limited to integrity loss without confidentiality or availability impact.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions within the affected plugin, potentially altering plugin behavior or settings. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or limiting its use to trusted environments. Monitor the vendor's communications for updates on patches or official mitigations.