CVE-2025-12373 describes a CSRF vulnerability in the Torod WordPress plugin (versions up to 1.9). The issue is due to missing or incorrect nonce validation on the save_settings function, which enables unauthenticated attackers to modify plugin settings by tricking an administrator into performing an action such as clicking a malicious link. This vulnerability does not require privileges but does require user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause an administrator to unknowingly modify the plugin's settings via a forged request. This could lead to unauthorized changes in the plugin configuration, potentially impacting the operation of the shipping and delivery portal. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links or performing actions from untrusted sources while logged into the WordPress admin interface. Monitoring vendor channels for updates or patches is recommended.