The RIS Version Switcher plugin for WordPress, developed by Md Taufiqur Rahman, contains a CSRF vulnerability (CVE-2025-57902) in versions up to 1.0. This vulnerability allows an attacker to trick authenticated users into executing unauthorized actions by exploiting the lack of proper request validation. The issue affects the integrity of the WordPress installation by potentially enabling unauthorized version changes. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to unknowingly downgrade or upgrade the WordPress version via the RIS Version Switcher plugin, potentially leading to integrity compromise of the WordPress environment. There is no direct impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the RIS Version Switcher plugin if not essential, or restrict access to trusted users only. Implementing standard CSRF protections such as verifying nonces or tokens in requests may mitigate risk if custom modifications are possible.