The vulnerability CVE-2025-66097 involves a CSRF issue in the I Order Terms plugin by Igor Jerosimić, affecting versions up to 1.5.0. This allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The impact is limited to a potential integrity violation caused by unauthorized actions performed via CSRF. There is no confidentiality or availability impact reported. The medium severity reflects the need for user interaction and the limited scope of the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, applying standard CSRF mitigations such as verifying anti-CSRF tokens and restricting actions to authenticated users may reduce risk.