Cross-Site Request Forgery Vulnerability in USS Upyun Plugin for WordPress

CVE-2025-9629

What is CVE-2025-9629?

The USS Upyun plugin for WordPress enables unauthorized modification of critical cloud storage configurations due to inadequate nonce validation in the uss_setting_page function. This vulnerability allows unauthenticated attackers to exploit the system by tricking site administrators into executing malicious requests, thus compromising sensitive information such as bucket names and operator credentials. The affected versions include all releases up to and including 1.5.0.

References