Cross-Site Request Forgery Vulnerability in WidgetPack Comment System for WordPress
CVE-2025-9621
4.3MEDIUM
What is CVE-2025-9621?
The WidgetPack Comment System plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery due to improper nonce validation in the wpcmt_sync action. By tricking a site administrator into clicking a malicious link, an attacker can initiate comment synchronization events, potentially compromising the integrity of the site's comment management. Users must update to a secure version to mitigate these risks.
Affected Version(s)
WidgetPack Comment System * <= 1.6.1
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Sandeep