The weichuncai (WP伪春菜) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.5. This vulnerability arises from missing or incorrect nonce validation on the sm-options.php page, allowing unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-7686 |
Exploitation
To exploit this vulnerability, an attacker must trick a site administrator into clicking a malicious link that sends a forged request to the sm-options.php page. This can be achieved through social engineering tactics, such as phishing emails or misleading messages that prompt the administrator to perform an action that triggers the vulnerability.
Affected Products
- weichuncai (WP伪春菜) plugin for WordPress: All versions up to and including 1.5 are affected by this vulnerability, allowing unauthorized changes to settings and potential script injection.
Mitigation
To mitigate this vulnerability, it is recommended to update the weichuncai plugin to the latest version that includes proper nonce validation. Additionally, site administrators should be cautious of unsolicited links and ensure that they are not tricked into performing actions that could exploit this vulnerability.