CVE-2025-54675 is a CSRF vulnerability affecting YITHEMES YITH WooCommerce Popup plugin versions up to 1.48.0. The vulnerability allows an attacker to trick authenticated users into submitting unauthorized requests, potentially causing limited impact on the integrity of the affected system. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or mitigation details are currently provided.

The vulnerability may allow an attacker to perform limited unauthorized actions by exploiting the CSRF flaw when a user interacts with a malicious request. The impact is limited to integrity with no confidentiality or availability effects. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitor vendor communications for updates.