Cross-Site Request Forgery in Last.fm Recent Album Artwork Plugin for WordPress
CVE-2025-7684
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 August 2025
What is CVE-2025-7684?
The Last.fm Recent Album Artwork plugin for WordPress is subject to a Cross-Site Request Forgery vulnerability due to improper nonce validation on the 'lastfm_albums_artwork.php' page. An attacker can exploit this vulnerability to trick a site administrator into executing unauthorized actions by clicking on a malicious link. This can lead to unauthorized modifications of plugin settings and potential injection of harmful web scripts, thus compromising the site's security.
Affected Version(s)
Last.fm Recent Album Artwork * <= 1.0.2