Cross-Site Request Forgery Vulnerability in Anti-Spam Plugin for WordPress

CVE-2025-2935

What is CVE-2025-2935?

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is susceptible to a Cross-Site Request Forgery attack due to improper nonce validation in specific files. Attackers can exploit this vulnerability to delete pending comments or reactivate blocked users if they successfully trick an administrator into executing malicious requests. This issue is present in all versions up to and including 2024.7, highlighting the importance of securing your WordPress environment against unauthorized actions.

References