Cross-Site Request Forgery in Publish Approval Plugin for WordPress
CVE-2025-9617

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Publish Approval
Vendor
CVE Published:
11 September 2025

What is CVE-2025-9617?

The Publish Approval plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) attacks across all versions up to and including 1.1. This vulnerability arises from inadequate or erroneous nonce validation within the publish_save_option function. Consequently, this enables unauthorized attackers to manipulate plugin settings through malicious requests, provided they can deceive an administrator into performing specific actions, such as clicking on a misleading link.

Affected Version(s)

Publish approval * <= 1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/publish-approv...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sandeep
.
CVE-2025-9617 : Cross-Site Request Forgery in Publish Approval Plugin for WordPress