CVE-2025-13142 is a CSRF vulnerability in the farvehandleren Custom Post Type WordPress plugin. The issue is caused by the absence of nonce validation on the custom post type deletion feature, enabling attackers to craft forged requests that, when executed by an authenticated administrator, result in deletion of custom post types without proper authorization checks. This vulnerability affects all plugin versions up to 1.0 and has a CVSS 3.1 base score of 4.3 (medium severity). No known exploits are reported in the wild, and no patch or remediation information is currently available.

An attacker can cause an authenticated site administrator to unknowingly delete custom post types by tricking them into clicking a malicious link or performing a crafted action. This leads to unauthorized modification of site content, specifically the deletion of custom post types, which can disrupt site functionality or content management. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger deletion actions. Implementing manual nonce validation or other CSRF protections in the plugin code may mitigate the risk. Monitor the vendor's channels for updates or patches addressing this vulnerability.