CVE-2025-11759 is a CSRF vulnerability in the XCloner WordPress plugin (versions up to 4.8.2) caused by missing or incorrect nonce validation in the Xcloner_Remote_Storage:save() function. This allows attackers to perform unauthorized changes to FTP backup configurations by tricking administrators into executing forged requests. The vulnerability could enable attackers to redirect backups to attacker-controlled FTP servers, risking data exfiltration. The CVSS score is 4.3 (medium severity). There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation permits an attacker to modify FTP backup settings without authentication by leveraging CSRF, potentially redirecting backups to attacker-controlled servers. This could lead to unauthorized access to sensitive backup data. The vulnerability does not directly impact confidentiality, integrity, or availability of the site beyond the backup configuration and data exfiltration risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider disabling or restricting the vulnerable plugin's backup configuration features. Implementing additional CSRF protections or nonce validation at the application level may mitigate risk.