Cross-Site Request Forgery Vulnerability in Torod Smart Shipping Plugin for WordPress
CVE-2025-12373
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 December 2025
What is CVE-2025-12373?
The Torod plugin, utilized for smart shipping and delivery in e-commerce, is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in its save_settings function. This weakness could allow malicious actors to alter the plugin settings without proper authentication, should they deceive an administrator into engaging with a harmful link. It is crucial for site administrators to remain vigilant and implement updates to mitigate potential risks associated with this vulnerability.
Affected Version(s)
Torod – The smart shipping and delivery portal for e-shops and retailers * <= 1.9