The Di Themes Demo Site Importer plugin versions up to 1.2 contain a CSRF vulnerability (CVE-2025-58914) that could allow an attacker to induce an authenticated user to perform unwanted actions via crafted requests. The vulnerability does not impact confidentiality or availability but can lead to integrity issues through unauthorized actions. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability can lead to unauthorized actions being performed by authenticated users without their consent, potentially modifying data or settings within the Di Themes Demo Site Importer plugin. There is no direct impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens on requests related to the plugin. Monitoring for updates from the vendor is recommended.