CVE-2025-53347: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Laborator Kalium, affecting versions through 3.18.3. The vulnerability was reported by Ananda Dhakal and published on August 14, 2025. This security issue allows Cross Site Request Forgery attacks against the Kalium WordPress theme (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The attack vector is Network-based, with Low attack complexity, requiring No privileges, but does need User interaction. The scope is Unchanged, with No impact on Confidentiality, Low impact on Integrity, and No impact on Availability. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (AttackerKB).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered Low priority with limited potential for exploitation (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. The issue affects Kalium versions through 3.18.3 (Patchstack).