Cross-Site Request Forgery Vulnerability in Admin in English with Switch Plugin for WordPress

CVE-2025-9623

What is CVE-2025-9623?

The Admin in English with Switch plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability across all versions up to and including 1.1. This flaw arises from inadequate nonce validation within the enable_eng function, allowing unauthorized attackers to alter administrator language settings. By deceiving a site administrator into executing an action, such as clicking a malicious link, an attacker can forge a request and gain control over vital site settings.

References