The TM Replace Howdy plugin for WordPress, developed by David Wood, contains a CSRF vulnerability identified as CVE-2025-49972. This affects all versions up to 1.4.2. The vulnerability allows attackers to induce authenticated users to perform unintended actions via crafted requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker could exploit this vulnerability to cause an authenticated user to perform unintended actions within the TM Replace Howdy plugin context, potentially altering data integrity to a limited extent. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the TM Replace Howdy plugin or implementing CSRF protections at the application or web server level to mitigate risk.