CVE-2025-10309 identifies a CSRF vulnerability in the bsmye PayPal Forms WordPress plugin versions up to 1.0.3. The root cause is the absence of nonce validation on critical administrative functions related to PayPal form creation and payment settings management. This lack of protection enables attackers to craft malicious requests that, when executed by an authenticated administrator, can alter plugin configurations without proper authorization. The vulnerability is network exploitable without privileges but requires user interaction (UI:R).

Successful exploitation can lead to unauthorized creation of PayPal payment forms and modification of payment settings by leveraging an administrator's authenticated session. This could potentially disrupt payment processing or redirect payments, but does not directly impact confidentiality or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or sites that could trigger forged requests. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.