CVE-2025-12827

Name of the Vulnerable Software and Affected Versions Top Friends plugin for WordPress versions prior to 0.4

Description The Top Friends plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce validation within the top friends options subpanel() function. An unauthenticated attacker could potentially modify plugin settings by tricking a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Top Friends plugin to version 0.4 or later.