Cross-Site Request Forgery in ContentMX Content Publisher Plugin for WordPress

CVE-2025-9889

What is CVE-2025-9889?

The ContentMX Content Publisher plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in the cmx_activate_connection function. This vulnerability allows unauthenticated attackers to execute actions on behalf of a legitimate site administrator by manipulating them into clicking a malicious link. Such actions could lead to unauthorized binding of connections, posing a significant security risk to WordPress sites using this plugin.

References