Cross-Site Request Forgery Vulnerability in Linux Promotional Plugin for WordPress

CVE-2025-7668

What is CVE-2025-7668?

The Linux Promotional Plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation on the 'linux-promotional-plugin.php' page. This weakness enables malicious actors to update plugin settings and inject harmful web scripts through forged requests. Attackers can potentially trick site administrators into executing these requests, highlighting the importance of ensuring proper nonce validation to secure WordPress installations.

References