Cross-Site Request Forgery Vulnerability in User Sync Plugin for WordPress

CVE-2025-9891

What is CVE-2025-9891?

The User Sync plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) due to inadequate or missing nonce validation in the mo_user_sync_form_handler() function. This weakness allows unauthenticated attackers to exploit the vulnerability by crafting a malicious request that can deactivate the plugin, provided they can trick an administrator into executing the request through methods such as clicking on a deceptive link. This poses a significant risk to WordPress sites using the affected versions of the plugin.

References