CVE-2025-12403 identifies a CSRF vulnerability in the revokee Associados Amazon Plugin for WordPress, affecting all versions up to and including 0.8. The root cause is the absence or improper implementation of nonce validation in the brzon_admin_panel() function, which is intended to protect against unauthorized state-changing requests. Exploitation requires tricking an authenticated site administrator into submitting a malicious request, potentially allowing attackers to modify plugin settings and inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to change plugin settings and inject malicious scripts via forged requests, potentially compromising site integrity and confidentiality. However, exploitation requires user interaction from an authenticated administrator, limiting the attack scope. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitoring for plugin updates from revokee is recommended.