CVE-2025-31601: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in appointy Appointy Appointment Scheduler through version 4.2.1. The vulnerability was disclosed on March 31, 2025, and assigned identifier CVE-2025-31601. This security issue affects the Appointy Appointment Scheduler WordPress plugin and allows attackers to perform Cross Site Request Forgery attacks (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. The issue is classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The software is considered abandoned as it was last updated over a year ago and will likely not receive further updates or fixes (Patchstack).

As there is no official fix available, it is recommended to remove and replace the software with an alternative solution. Deactivating the software alone does not remove the security threat unless a virtual patch (vPatch) is deployed (Patchstack).