The vulnerability identified as CVE-2025-49895 involves a CSRF flaw in the iThemes ServerBuddy plugin by PluginBuddy.com, which permits object injection attacks. The affected versions include all releases up to 1.0.5. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts integrity but not confidentiality or availability. No known exploits are reported in the wild, and no vendor patch or advisory details are available at this time.

Successful exploitation of this CSRF vulnerability can allow an attacker with low privileges to inject objects, potentially altering the behavior of the plugin or the server environment. This impacts the integrity of the affected system but does not affect confidentiality or availability according to the CVSS vector. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the plugin's administrative interfaces and employing CSRF protection mechanisms if possible. Monitor vendor channels for updates and apply patches promptly once available.