CVE-2026-25319 describes a CSRF vulnerability in the wpzita Zita Elementor Site Library plugin for WordPress, affecting versions up to 1.6.6. The vulnerability allows unauthorized commands to be transmitted from a user that the web application trusts, potentially leading to limited impact on integrity. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability could allow an attacker to trick authenticated users into submitting unwanted requests, potentially modifying data or settings within the plugin context. However, the impact is limited to integrity with no confidentiality or availability effects. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin if feasible or limit exposure by restricting user roles that can interact with the plugin. Monitor official wpzita channels for updates.