The vulnerability CVE-2025-57978 is a CSRF issue in the themespride Advanced Appointment Booking & Scheduling plugin, affecting versions up to 2.1. It allows attackers to perform unauthorized state-changing requests by exploiting the lack of proper CSRF protections. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and results in low impact on integrity without affecting confidentiality or availability.

Successful exploitation could allow an attacker to induce an authenticated user to perform unintended actions within the affected plugin, potentially altering booking or scheduling data. The impact is limited to integrity with no direct confidentiality or availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting access to trusted users. Monitor vendor channels for updates regarding patches or official mitigations.