The vulnerability CVE-2025-49291 exists in the codepeople Calculated Fields Form plugin, versions up to 5.3.58, where insufficient protection against Cross-Site Request Forgery (CSRF) allows attackers to trick authenticated users into submitting unauthorized requests. This can lead to limited integrity impact as unauthorized actions may be performed. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited integrity impact without confidentiality or availability impact. No official patch or vendor advisory is currently provided.

The impact of this vulnerability is limited to potential unauthorized actions performed via CSRF attacks, which may alter data or state within the affected plugin. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing standard CSRF mitigations such as verifying request origins, using anti-CSRF tokens, or restricting form submissions to trusted users. Monitor the vendor's communications for updates on patches or official mitigations.