CVE-2025-13134 is a CSRF vulnerability in the AuthorSure plugin for WordPress, affecting all versions up to and including 2.3. The issue arises from missing or incorrect nonce validation on the 'authorsure' page, which enables attackers to craft malicious requests that, if executed by an authenticated administrator, can alter plugin settings or inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, potentially leading to unauthorized changes in plugin settings and injection of malicious scripts. This can compromise the confidentiality and integrity of the affected WordPress site. There is no indication of availability impact or known active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger actions in the AuthorSure plugin. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any forthcoming patches promptly.