CVE-2025-4966 is a CSRF vulnerability in the WP Online Users Stats plugin for WordPress, affecting all versions up to 1.0.0. The root cause is the absence of nonce validation in the hk_dataset_results() function, which is intended to protect against forged requests. This flaw enables attackers to craft malicious requests that, if executed by an authenticated site administrator, could lead to unauthorized actions. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a crafted link, causing the administrator's browser to perform unintended actions on the vulnerable WordPress site. This can lead to partial disclosure or modification of data within the plugin's scope. There is no indication of availability impact or privilege escalation. No known exploits are currently reported.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory channels for updates. As a temporary mitigation, administrators can avoid clicking on untrusted links and consider disabling or removing the WP Online Users Stats plugin until a fix is released.