CVE-2025-10588 is a Cross-Site Request Forgery vulnerability in the PixelYourSite – Your smart PIXEL (TAG) & API Manager WordPress plugin affecting all versions up to 11.1.2. The issue arises from missing or incorrect nonce validation in the adminEnableGdprAjax() function, which handles GDPR settings. An attacker can exploit this by tricking an authenticated site administrator into submitting a forged request, thereby modifying GDPR configurations without proper authorization. The vulnerability is network exploitable with low attack complexity and requires user interaction but no privileges. The CVSS 3.1 base score is 4.3 (medium severity).

Successful exploitation allows an attacker to modify GDPR settings on a vulnerable WordPress site by leveraging an administrator's interaction with a malicious request. This could lead to unauthorized changes in privacy configurations, potentially affecting compliance or site behavior related to GDPR. There is no direct confidentiality, availability, or integrity impact beyond the modification of GDPR settings as per the CVSS vector and description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links or requests that could trigger GDPR settings changes. Monitoring vendor channels for updates or patches is recommended.