CVE-2025-5936 is a CSRF vulnerability in the VR Calendar WordPress plugin caused by improper nonce validation in the syncCalendar() function. This flaw enables unauthenticated attackers to induce a site administrator to perform unintended actions, specifically triggering a calendar synchronization through a crafted request. The vulnerability affects all versions up to 2.4.7. The CVSS 3.1 base score is 4.3 (medium), reflecting the requirement for user interaction and the limited impact on integrity without confidentiality or availability loss. No patch or vendor advisory is currently available to confirm remediation status.

An attacker can exploit this vulnerability by convincing an authenticated site administrator to click a malicious link, causing the calendar sync operation to execute without proper authorization. This may lead to unintended changes or synchronization actions within the calendar plugin, impacting data integrity. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger calendar sync actions. Implementing manual nonce validation or other CSRF protections at the application level may reduce risk. Monitor vendor channels for updates and apply patches promptly once available.