Cross-Site Request Forgery in Analytics Reduce Bounce Rate Plugin for WordPress

CVE-2025-9635

What is CVE-2025-9635?

The Analytics Reduce Bounce Rate plugin for WordPress has a vulnerability that enables unauthenticated attackers to exploit Cross-Site Request Forgery due to inadequate nonce validation in the unbounce_options function. This flaw permits attackers to potentially alter Google Analytics tracking settings by crafting a malicious request, provided they can deceive a site administrator into executing an action, such as clicking on a compromised link. Users should take immediate action to limit exposure by upgrading to the latest plugin version or implementing necessary security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References