Cross-Site Request Forgery Vulnerability in Associados Amazon Plugin for WordPress

CVE-2025-12403

What is CVE-2025-12403?

The Associados Amazon Plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the brzon_admin_panel() function. This flaw allows unauthorized attackers to manipulate plugin settings and potentially inject malicious scripts if they can convince a site administrator to click a deceptive link. All versions up to and including 0.8 are impacted, making it crucial for users to address this security concern promptly.

References