CVE-2025-10055 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the mrdenny Time Sheets plugin for WordPress in all versions up to 2.1.3. The issue arises from missing or incorrect nonce validation on several plugin endpoints, enabling attackers to forge requests that an authenticated site administrator might unwittingly execute. This can lead to unauthorized actions being performed without the administrator's explicit intent. The vulnerability is remotely exploitable without privileges but requires user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting low complexity and limited impact on integrity only.

An attacker can exploit this vulnerability to cause an authenticated administrator to perform unintended actions on the affected WordPress site by tricking them into clicking a malicious link. The impact is limited to integrity, with no confidentiality or availability effects reported. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, administrators should monitor the vendor's communications for updates. In the meantime, limiting administrator exposure to untrusted links and employing general CSRF protections at the WordPress or server level may reduce risk.