CVE-2025-12412 is a CSRF vulnerability in the josereyev Top Bar Notification WordPress plugin affecting all versions up to 1.12. The issue arises from improper or missing nonce validation in the tbn_ajax_add() function, enabling attackers to forge requests that update plugin settings and inject malicious web scripts. Exploitation requires tricking an authenticated site administrator into executing an action, such as clicking a malicious link. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.1 (Network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, no availability impact). No known exploits are reported in the wild, and no patch or official fix has been indicated in the provided data.

Successful exploitation could allow an attacker to modify plugin settings and inject malicious scripts, potentially leading to partial compromise of site confidentiality and integrity. The attack requires user interaction from an administrator, limiting the ease of exploitation. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and actions performed by site administrators related to this plugin. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.