CVE-2025-12128 is a CSRF vulnerability in the Hide Categories Or Products On Shop Page WordPress plugin (versions up to 1.0.7). The issue arises from missing or incorrect nonce validation in the save_data_hcps() function, which handles saving plugin settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (via UI interaction), results in unauthorized changes to the plugin's configuration. This vulnerability does not require prior authentication but does require user interaction by an admin. No known exploits are reported in the wild, and no patch or remediation details are provided.

Successful exploitation allows an attacker to alter the plugin's settings without authentication by leveraging an administrator's interaction with a malicious request. This could lead to unauthorized configuration changes, potentially affecting site behavior related to category or product visibility on the shop page. There is no direct confidentiality or availability impact indicated by the CVSS vector, only integrity is affected at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links or requests while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.