The vulnerability CVE-2025-67626 in Angel Costa WP SEO Search plugin is a Cross-Site Request Forgery (CSRF) issue affecting versions up to 1.1. It allows attackers to induce authenticated users to perform unwanted actions via crafted requests. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. There is no vendor advisory or patch information available at this time.

The impact is limited to potential unauthorized modification of data or settings within the WP SEO Search plugin due to CSRF. There is no impact on confidentiality or availability. The medium severity reflects the possibility of integrity compromise without elevated privileges or complex attack conditions. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to authenticated users to trusted parties. Monitor for updates from Angel Costa regarding patches or official mitigations.