CVE-2025-9633

Name of the Vulnerable Software and Affected Versions LH Signing plugin for WordPress versions prior to 2.84

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the plugin options() function. This allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update the plugin to a version newer than 2.83. As a temporary mitigation, restrict access to the plugin options() function.