CVE-2025-9632

Name of the Vulnerable Software and Affected Versions PhpList Subber versions prior to 1.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the bulk action handler() function. This allows unauthenticated attackers to trigger bulk synchronization of subscription forms by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update the plugin to a version later than 1.1. As a temporary workaround, restrict access to the bulk action handler() function until the update is applied.