Cross-Site Request Forgery Vulnerability in TeachPress Plugin for WordPress

CVE-2025-1320

What is CVE-2025-1320?

The TeachPress plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) attack due to inadequate nonce validation on the import.php page. This vulnerability allows unauthenticated attackers to execute unauthorized actions, such as deleting imports, by tricking site administrators into executing malicious requests through deceptive links. It's crucial for WordPress site owners using the TeachPress plugin to ensure they are running the latest version and to implement additional security measures to mitigate the risk.

References