CVE-2025-9893

Name of the Vulnerable Software and Affected Versions VM Menu Reorder plugin for WordPress versions prior to 1.0.1

Description The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is because of a lack of, or incorrect, nonce validation in the vm set to default function. An unauthenticated attacker could potentially reset all menu reordering settings by tricking a site administrator into performing an action, such as clicking a link.

Recommendations Update the VM Menu Reorder plugin to version 1.0.1 or later.