CVE-2025-12406 is a CSRF vulnerability in the Project Honey Pot Spam Trap WordPress plugin (awensley) affecting all versions up to 1.0.1. The issue arises from missing or incorrect nonce validation on the printAdminPage() function, which is responsible for rendering the administrative interface. This allows attackers to forge requests that an authenticated administrator might unknowingly execute, leading to unauthorized changes in plugin settings and possible injection of malicious web scripts. The vulnerability is network exploitable without privileges but requires user interaction (UI:R).

An attacker can exploit this vulnerability to modify plugin settings and inject malicious scripts by tricking an authenticated administrator into clicking a malicious link. This can lead to partial confidentiality and integrity loss within the affected WordPress environment. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on suspicious links and limiting administrative access. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.