CVE-2025-62873 is a CSRF vulnerability affecting the WP Flashy Marketing Automation WordPress plugin up to version 2.0.8. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request that could cause unintended actions within the plugin. The attack vector is network-based, with low attack complexity and no privileges required, but it requires user interaction. The vulnerability does not impact confidentiality or availability but has a low impact on integrity.

The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially modifying plugin settings or behavior. There is no impact on confidentiality or availability, and the integrity impact is low. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor or plugin maintainers. Until a fix is available, limiting user interaction with untrusted sites and applying general CSRF mitigations at the WordPress or server level may reduce risk.