Cross-Site Request Forgery in HidePost Plugin for WordPress
CVE-2025-9896

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Hidepost
Vendor
CVE Published:
27 September 2025

What is CVE-2025-9896?

The HidePost plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation on the settings page. This vulnerability enables unauthorized attackers to exploit this weakness by tricking an administrator into executing a malicious action, thereby allowing potential modifications to plugin settings without proper authentication.

Affected Version(s)

HidePost * <= 2.3.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/hidepost/tags/...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sandeep
JSON
.
CVE-2025-9896 : Cross-Site Request Forgery in HidePost Plugin for WordPress