CVE-2025-9617

Name of the Vulnerable Software and Affected Versions Publish approval plugin for WordPress versions prior to 1.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the publish save option() function. A nonce is a unique token used to protect against forged requests. This flaw allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.1. As a temporary mitigation, restrict access to the publish save option() function.