CVE-2025-28881: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in mg12 Mobile Themes WordPress plugin, tracked as CVE-2025-28881. The vulnerability affects Mobile Themes versions through 1.1.1 and was discovered by Nguyen Xuan Chien on February 25, 2025, with public disclosure occurring on March 11, 2025 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue is classified under CWE-352 (Cross-Site Request Forgery) and requires no authentication to exploit (Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low, and the vulnerability is unlikely to be exploited according to security assessments (Patchstack).

The vulnerability requires no authentication to exploit and has been classified with low attack complexity. As of the latest reports, no official fix is available for this vulnerability (Patchstack).

Currently, no official fix has been released for this vulnerability. Given the low severity impact, virtual patching has been deemed unnecessary by security researchers (Patchstack).