The vulnerability CVE-2025-49977 in WP Inventory Manager is a CSRF issue present in versions up to 2.3.4. It allows an attacker to induce an authenticated user to perform unintended actions via crafted requests. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. There is no information about an official fix or patch from the vendor, and no known exploitation has been reported.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to perform unintended actions within the WP Inventory Manager plugin. The impact is limited to integrity as per the CVSS vector, with no confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitoring for vendor updates is recommended.