CVE-2025-27336: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the Just Variables WordPress plugin developed by Alex Prokopenko / JustCoded. The vulnerability affects versions up to 1.2.3 and was disclosed on February 24, 2025. The vulnerability was initially reported by security researcher Nguyen Xuan Chien on February 15, 2025 (Patchstack).

The vulnerability has been assigned CVE-2025-27336 and received a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). This security issue requires no authentication to exploit and has been categorized as having a low patch priority (Patchstack).

The CSRF vulnerability could potentially allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low, and the vulnerability is unlikely to be exploited according to the assessment (Patchstack).

The vulnerability requires user interaction (UI:R in CVSS score) but no privileges (PR:N) to exploit. It can be accessed through network vectors (AV:N) with low attack complexity (AC:L) (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects Just Variables plugin versions up to 1.2.3 (Patchstack).