CVE-2026-25422 is a CSRF vulnerability affecting the Themes4WP Popularis Extra plugin for WordPress, specifically versions up to 1.2.10. The vulnerability allows an attacker to trick authenticated users into submitting unwanted requests, potentially leading to limited integrity and availability impacts. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity and availability but not confidentiality.

Successful exploitation could result in limited integrity and availability impacts on the affected system, such as unauthorized changes or disruptions caused by forged requests executed in the context of an authenticated user. Confidentiality is not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitor official Themes4WP channels for updates and apply patches promptly once released.