CVE-2025-11497 describes a CSRF vulnerability in the symptote Advanced Database Cleaner WordPress plugin, affecting all versions up to 3.1.6. The issue arises from improper input validation (CWE-20) due to missing or incorrect nonce validation in the aDBc_prepare_elements_to_clean() function. This flaw enables an attacker to perform unauthorized changes to plugin settings by leveraging a forged request that requires user interaction from an administrator. The vulnerability does not impact confidentiality or availability but can cause limited integrity loss by altering plugin configuration.

An attacker can cause limited integrity impact by changing the 'keep last' setting of the plugin without authentication, but only if an administrator is tricked into clicking a malicious link. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor is recommended.