Cross-Site Request Forgery Vulnerability in Maspik Ultimate Spam Protection Plugin for WordPress

CVE-2025-9888

What is CVE-2025-9888?

The Maspik – Ultimate Spam Protection plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the clear_log function through Cross-Site Request Forgery. This issue arises due to inadequate nonce validation, which can enable an attacker to deceive a site administrator into triggering a request that clears all spam logs. As a result, sensitive information may be compromised, and site integrity at risk if proper security measures are not implemented.

References