CVE-2025-12413 is a CSRF vulnerability in the Social Media WPCF7 Stop Words plugin for WordPress, affecting all versions up to and including 1.1.3. The vulnerability arises from missing or incorrect nonce validation in the smWpCfSwOptions() function, which handles plugin settings updates. An attacker can exploit this by crafting a forged request that, if executed by a site administrator, allows unauthorized modification of plugin settings and injection of malicious web scripts. The CVSS 3.1 base score is 5.4 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation enables an attacker to update plugin settings without authentication by leveraging CSRF, potentially leading to injection of malicious scripts. This can degrade the integrity and availability of the affected WordPress site. There is no direct confidentiality impact reported. The attack requires tricking an authenticated site administrator into performing an action such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution by avoiding clicking on untrusted links while logged into WordPress admin accounts and consider disabling or removing the vulnerable plugin if feasible.