CVE-2025-12827 is a CSRF vulnerability in the denishua Top Friends WordPress plugin versions up to 0.3. The issue arises from the absence of nonce validation in the top_friends_options_subpanel() function, which is responsible for handling plugin settings. This flaw enables attackers without authentication to alter plugin settings by exploiting an administrator's interaction with a maliciously crafted request. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3, reflecting low attack complexity and no required privileges but requiring user interaction.

An attacker can modify the plugin settings without authentication by tricking an administrator into clicking a malicious link. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or security. There is no indication of direct confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the site level.