Cross-Site Request Forgery Vulnerability in Ajax Comment Form CST Plugin for WordPress

CVE-2025-3867

What is CVE-2025-3867?

The Ajax Comment Form CST plugin for WordPress is susceptible to Cross-Site Request Forgery, allowing unauthorized attackers to exploit weaknesses in nonce validation on the 'acform_cst_settings' page. Without proper nonce checks, attackers can potentially trick site administrators into executing malicious actions, such as changing configurations or injecting harmful scripts, simply by enticing them to click on a deceptive link. This vulnerability underscores the necessity for robust validation mechanisms to prevent unauthorized settings manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References