Cross-Site Request Forgery Vulnerability in LH Signing Plugin for WordPress

CVE-2025-9633

What is CVE-2025-9633?

The LH Signing plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation on the plugin_options function. This vulnerability allows unauthenticated attackers to alter plugin settings if they can deceive a site administrator into executing a malicious request, such as by clicking a specially crafted link. All versions up to and including 2.83 are affected, highlighting the importance of secure coding practices in plugin development.

References