CVE-2025-9634

Name of the Vulnerable Software and Affected Versions Plugin updates blocker for WordPress versions prior to 0.3

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation—a security token used to prevent forged requests—on the pub save action handler. This allows unauthenticated attackers to enable or disable plugin updates by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 0.2.