CVE-2025-67651 is a CWE-352 Cross-Site Request Forgery vulnerability affecting PHP Jabbers Appointment Scheduler. The vulnerability is due to missing CSRF protections such as tokens or SameSite cookie attributes, allowing attackers to send unauthorized requests on behalf of authenticated users. This can lead to unauthorized administrative actions like creating new admin accounts. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity. The vulnerability has been fixed in certain versions, but no explicit patch or remediation details are provided in the available data.

Successful exploitation allows an attacker to perform unauthorized administrative actions, including creating new admin accounts, by tricking authenticated users into submitting malicious requests. This compromises the integrity of the affected system and potentially grants elevated privileges to attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that the issue was fixed in certain versions, so applying official updates from PHP Jabbers Appointment Scheduler is recommended once available. Until patched, users should implement CSRF protections such as CSRF tokens and enforce SameSite cookie attributes if possible.