CVE-2025-31616: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in AdminGeekZ Varnish WordPress plugin affecting versions through 1.7. The vulnerability was disclosed on March 31, 2025, and assigned identifier CVE-2025-31616 (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact affects confidentiality, integrity, and availability, each at a low level according to the CVSS scoring (Patchstack).

The vulnerability requires no privileges (unauthenticated) to exploit, though it does require user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Patchstack).

No official fix is currently available for this vulnerability. As the software appears to be abandoned (last updated over a year ago), users are strongly advised to remove and replace the plugin with an alternative solution (Patchstack).