CVE-2025-12403

Name of the Vulnerable Software and Affected Versions Associados Amazon Plugin versions prior to 0.9

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the brzon admin panel() function. This allows unauthenticated attackers to update settings and inject malicious web scripts by tricking a site administrator into clicking a forged link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user.

Recommendations Update the plugin to a version newer than 0.8. As a temporary workaround, restrict access to the brzon admin panel() function until the update is applied.