The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This vulnerability arises from missing or incorrect nonce validation on the ‘LatestCheckins’ page. As a result, unauthenticated attackers can update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-7683 |
Exploitation
To exploit this vulnerability, an attacker must trick a site administrator into clicking a malicious link that sends a forged request to the LatestCheckins plugin. This can be achieved through social engineering tactics, such as sending an email or message that appears legitimate, prompting the administrator to perform an action that updates settings or injects malicious scripts.
Affected Products
- LatestCheckins Plugin: A WordPress plugin that allows users to display their latest check-ins from various social media platforms. The vulnerability affects all versions up to and including version 1.
Mitigation
To mitigate this vulnerability, it is recommended to update the LatestCheckins plugin to the latest version where nonce validation has been properly implemented. Additionally, site administrators should be cautious of unsolicited links and ensure that they are not tricked into performing actions that could compromise the security of their site.