CVE-2025-12188 identifies a CSRF vulnerability in the Posts Navigation Links for Sections and Headings – Free by WP Masters WordPress plugin, affecting all versions up to 1.0.1. The issue arises from missing or incorrect nonce validation on the 'wpm_navigation_links_settings' page, enabling attackers to forge requests that update plugin settings when an administrator interacts with a crafted link. The vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows limited integrity impact by changing plugin settings.

An attacker can cause an authenticated administrator to unknowingly modify plugin settings via a forged request, potentially altering site behavior or configuration. There is no direct confidentiality or availability impact reported. The vulnerability requires tricking an administrator into clicking a malicious link, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with unsolicited links and consider restricting access to the plugin settings page. Monitoring for updates from WP Masters regarding a security patch is recommended.