CVE-2025-47684: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the Smaily for WP WordPress plugin affecting versions through 3.1.6. The vulnerability was initially reported on March 20, 2025, and was publicly disclosed on May 7, 2025 (Patchstack).

The vulnerability has been assigned CVE-2025-47684 and is classified under CWE-352 (Cross-Site Request Forgery). It received a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The vulnerability requires no authentication to exploit (NVD, Wiz).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The attack can be initiated remotely, potentially leading to unauthorized actions being performed on behalf of authenticated users (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. No public exploits have been reported at the time of disclosure (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. Given the low severity impact, virtual patching has been deemed unnecessary (Patchstack).