CVE-2025-57934 describes a Cross-Site Request Forgery (CSRF) vulnerability in the LWS Affiliation plugin by Aurélien LWS, affecting versions through 2.3.6. CSRF vulnerabilities enable attackers to induce authenticated users to perform unwanted actions without their consent. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed. The impact is limited to integrity with no confidentiality or availability impact. No patches or vendor advisories are currently provided, and no known exploits have been reported.

The vulnerability allows attackers to perform unauthorized actions by exploiting the trust of an authenticated user via CSRF. The impact is limited to integrity, with no direct confidentiality or availability consequences. The medium CVSS score reflects the need for user interaction and the absence of required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing standard CSRF mitigations such as verifying CSRF tokens in requests or restricting actions to POST methods where feasible. Monitor vendor announcements for updates and apply patches promptly once released.