The Auto Prune Posts plugin by ramon fincken, versions up to 3.0.0, contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2025-64262). This vulnerability allows attackers to induce authenticated users to perform unintended actions via crafted requests. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to perform unauthorized actions that affect the integrity of the system or data managed by the Auto Prune Posts plugin. There is no impact on confidentiality or availability reported. The medium severity score reflects the potential for significant integrity impact without requiring privileges but needing user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the Auto Prune Posts plugin, or implementing CSRF protections such as verifying request origins or tokens where possible. Monitor vendor channels for updates and apply patches promptly once available.