Cross-Site Request Forgery Vulnerability in WidgetPack Comment System for WordPress

CVE-2025-9621

What is CVE-2025-9621?

The WidgetPack Comment System plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery due to improper nonce validation in the wpcmt_sync action. By tricking a site administrator into clicking a malicious link, an attacker can initiate comment synchronization events, potentially compromising the integrity of the site's comment management. Users must update to a secure version to mitigate these risks.

References