CVE-2025-27328: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress plugin WP-PostRatings Cheater, affecting versions up to 1.5. The vulnerability was reported by Nguyen Xuan Chien on February 15, 2025, and was publicly disclosed on February 24, 2025. The issue has been assigned CVE-2025-27328 and received a CVSS v3.1 score of 4.3 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). It received a CVSS v3.1 Base Score of 4.3 (Medium) with the following vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction (NVD, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity impact is considered low and is unlikely to be exploited (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The security issue has been assessed as having a low severity impact, and Patchstack has indicated that a virtual patch is unnecessary (Patchstack).