Cross-Site Request Forgery Vulnerability in WordPress Custom Login and Signup Widget
CVE-2025-9887
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 September 2025
What is CVE-2025-9887?
The Custom Login And Signup Widget plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the file /frndzk_adminclsw.php. This flaw allows unauthenticated attackers to execute unauthorized actions, potentially altering email and username settings if they can deceive a site administrator into clicking a malicious link. Website owners should assess their security measures to prevent such exploit attempts.
Affected Version(s)
Custom Login And Signup Widget * <= 1.0