The vulnerability CVE-2025-58804 exists in the WooCommerce Single Page Checkout plugin by brijrajs, specifically in versions up to 1.2.7. It is a Cross-Site Request Forgery (CSRF) issue, which means an attacker could potentially induce a logged-in user to perform actions without their consent by exploiting the lack of proper request validation. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and limited impact on integrity without affecting confidentiality or availability.

The impact is limited to integrity as the vulnerability could allow unauthorized actions to be performed via CSRF, but it does not affect confidentiality or availability. No known exploits have been reported in the wild, and the attack requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or disabling the plugin if it is not essential.