CVE-2025-68529 is a CSRF vulnerability in the WP Email Capture WordPress plugin developed by Rhys Wynne. The issue affects all versions up to 3.12.5 and allows attackers to perform unauthorized state-changing actions by exploiting the lack of proper CSRF protections. The vulnerability has a CVSS v3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. Confidentiality and availability impacts are none, with only a low impact on integrity.

Successful exploitation could allow an attacker to cause an authenticated user to perform unintended actions within the WP Email Capture plugin, potentially altering plugin settings or data. The impact is limited to integrity with no confidentiality or availability effects. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as nonce verification or restricting access to trusted users. Monitoring vendor channels for updates is recommended.