Cross-Site Request Forgery in Analytics Reduce Bounce Rate Plugin for WordPress

CVE-2025-9635

What is CVE-2025-9635?

The Analytics Reduce Bounce Rate plugin for WordPress has a vulnerability that enables unauthenticated attackers to exploit Cross-Site Request Forgery due to inadequate nonce validation in the unbounce_options function. This flaw permits attackers to potentially alter Google Analytics tracking settings by crafting a malicious request, provided they can deceive a site administrator into executing an action, such as clicking on a compromised link. Users should take immediate action to limit exposure by upgrading to the latest plugin version or implementing necessary security measures.

References