Cross-Site Request Forgery Vulnerability in Seraphinite Accelerator Plugin for WordPress

CVE-2025-6059

What is CVE-2025-6059?

The Seraphinite Accelerator plugin for WordPress contains a Cross-Site Request Forgery vulnerability due to missing or improper nonce validation in the 'OnAdminApi_CacheOpBegin' function. This flaw allows unauthenticated attackers to execute various administrative actions, such as clearing the cache, if they successfully convince a site administrator to interact with a malicious link or request.

References