CVE-2025-64271 is a CSRF vulnerability in the HasThemes WP Plugin Manager plugin for WordPress. It affects all versions up to 1.4.7. The vulnerability allows an attacker to induce an authenticated user to execute unwanted actions without their consent by exploiting the lack of proper CSRF protections. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability can lead to unauthorized modification of plugin manager settings or actions performed on behalf of an authenticated user, potentially altering site behavior or configuration. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a patch is available, users should consider implementing CSRF protections such as nonce verification or restricting access to the plugin manager to trusted users only.