Cross-Site Request Forgery in Disable Content Editor For Specific Template for WordPress

CVE-2025-12072

What is CVE-2025-12072?

The Disable Content Editor For Specific Template plugin for WordPress possesses a vulnerability that enables Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0. This flaw arises from the absence of nonce validation when making updates to template configurations. As a result, unauthenticated adversaries can exploit this vulnerability by tricking an administrator into executing unauthorized actions, such as adding or deleting template configurations, through a crafted request.

References