The vulnerability CVE-2025-63030 exists in the New User Approve plugin by Saad Iqbal, affecting versions up to 3.2.3. It is a Cross-Site Request Forgery (CSRF) issue that could allow an attacker to cause an authenticated user to unknowingly execute actions related to user approval. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

The vulnerability could allow an attacker to induce an authenticated user to perform unintended actions that may affect the integrity and availability of the system related to user approval processes. There is no confidentiality impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests related to user approval actions. Monitor official channels for updates or patches from the vendor.