CVE-2025-13366

Name of the Vulnerable Software and Affected Versions Rabbit Hole versions prior to 1.2

Description The plugin is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are intentional—within the reset functionality. Unauthenticated attackers can reset plugin settings by tricking a site administrator into clicking a link or loading an image tag, as the reset operation is executed via a GET request.

Recommendations Update the plugin to version 1.2 or later.