CVE-2025-64286 is a CSRF vulnerability in the WP Rentals plugin for WordPress developed by WpEstate. It affects all versions up to 3.13.1. The vulnerability enables attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized changes within the application. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact is limited to integrity with no confidentiality or availability impact.

The vulnerability allows an attacker to induce an authenticated user to perform unintended actions, potentially altering data or application state without the user's consent. There is no impact on confidentiality or availability. No known exploits have been observed in the wild, suggesting limited active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests and limiting user privileges where possible. Monitor official WpEstate communications for updates on patches or mitigations.