CVE-2025-13413 describes a CSRF vulnerability in the Country Blocker for AdSense WordPress plugin by soyrodriguez. The issue arises from the absence of nonce validation in the CBFA_guardar_cbfa() function, enabling attackers to forge requests that update plugin settings without authentication, relying on user interaction by an administrator. The vulnerability affects all versions up to 1.0. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and impact limited to integrity.

An attacker can cause an authenticated administrator to unknowingly change the plugin's settings via a crafted request, potentially altering the behavior of the Country Blocker for AdSense plugin. There is no direct confidentiality or availability impact reported. The integrity of plugin settings can be compromised, which may affect site functionality related to ad blocking by country.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.