CVE-2025-13363 is a CSRF vulnerability in the IMAQ Core WordPress plugin (versions ≤1.2.1) caused by the absence of nonce validation on the URL structure settings update feature. This flaw enables attackers to craft malicious requests that, if executed by an authenticated site administrator, can alter plugin settings without proper authorization. The vulnerability is network exploitable without privileges but requires user interaction (UI:R). The impact is limited to integrity loss with no confidentiality or availability impact reported.

An attacker can cause an authenticated administrator to unknowingly change the URL structure settings of the IMAQ Core plugin by tricking them into clicking a malicious link. This results in a loss of integrity of the plugin configuration. There is no direct impact on confidentiality or availability. No known active exploitation has been reported.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, administrators should exercise caution when interacting with untrusted links and consider limiting administrative access or using additional security plugins that provide CSRF protections.