CVE-2025-13366 is a CSRF vulnerability in the Rabbit Hole WordPress plugin (versions up to 1.1) caused by missing or incorrect nonce validation on the plugin's reset functionality. This flaw enables unauthenticated attackers to reset plugin settings by tricking an administrator into performing an action such as clicking a link. The reset operation is executed via a GET request, which lowers the barrier to exploitation. The vulnerability does not impact confidentiality or availability but can lead to integrity loss by unauthorized resetting of plugin settings.

An attacker can cause an administrator to unknowingly reset the plugin's settings, potentially disrupting site configuration or behavior controlled by Rabbit Hole. There is no direct impact on confidentiality or availability, but the integrity of the plugin's configuration is compromised. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider disabling or restricting access to the reset functionality. Implementing manual nonce validation or modifying the plugin to use POST requests for sensitive actions can reduce risk.