Cross-Site Request Forgery in LockerPress WordPress Security Plugin

CVE-2025-9946

What is CVE-2025-9946?

The LockerPress – WordPress Security Plugin is susceptible to Cross-Site Request Forgery vulnerabilities in all versions prior to 1.0. This flaw stems from inadequate nonce validation, enabling unauthenticated attackers to potentially alter plugin settings and execute malicious scripts by tricking a site administrator into clicking a deceptive link. Effective nonce validation is crucial to preventing unauthorized actions and protecting site integrity.

References