CVE-2025-68604

Root Cause: The WPGraphQL plugin for WordPress versions up to 2.5.3 lacks proper CSRF protection, making it vulnerable to Cross-Site Request Forgery attacks [1].

Exploitation: An attacker can exploit this by tricking a privileged user (e.g., an administrator) into clicking a malicious link or visiting a crafted page. This triggers unwanted actions under the victim's authenticated session without their consent [1].

Impact: Successful exploitation allows the attacker to force the victim to perform actions such as modifying plugin settings, altering GraphQL schema, or other administrative operations, potentially compromising the site's integrity [1].

Mitigation: The vulnerability is patched in version 2.5.4. Users are strongly advised to update immediately. Patchstack also notes that such vulnerabilities are used in mass-exploit campaigns, emphasizing the need for prompt action [1].