CVE-2025-66064 is a CSRF vulnerability affecting the Giveaways and Contests by RafflePress plugin for WordPress, specifically versions up to and including 1.12.20. The vulnerability allows an attacker to induce an authenticated user to submit unauthorized requests, potentially leading to limited integrity impact. The CVSS vector indicates the attack requires network access, no privileges, and user interaction, with no confidentiality or availability impact. No vendor advisory or patch information is provided in the available data.

The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially modifying contest or giveaway data. The impact is limited to integrity with no confidentiality or availability effects. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or restricting access to trusted users only. Monitor official channels from Syed Balkhi or RafflePress for updates and apply any released patches promptly.