Cross-Site Request Forgery Vulnerability in Restore Permanently Delete Post or Page Data Plugin for WordPress

CVE-2025-7839

What is CVE-2025-7839?

The Restore Permanently Delete Post or Page Data plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This vulnerability occurs due to inadequate nonce validation in the rp_dpo_dpa_ajax_dp_delete_data() function, allowing unauthenticated attackers to manipulate actions on the site. By tricking an administrator into executing a forged request, an attacker could delete posts or pages without proper authorization. To mitigate this threat, it is crucial for site owners to update the plugin to the latest version and implement appropriate security measures.

References