Cross-Site Request Forgery Vulnerability in iThoughts Advanced Code Editor for WordPress
CVE-2025-7835
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 July 2025
What is CVE-2025-7835?
The iThoughts Advanced Code Editor plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation on the 'ithoughts_ace_update_options' AJAX action. This vulnerability allows unauthenticated attackers to manipulate plugin settings by convincing an administrator to execute a malicious request, such as clicking a specially crafted link.
Affected Version(s)
iThoughts Advanced Code Editor * <= 1.2.10