CVE-2025-13520 is a CSRF vulnerability in the MTCaptcha WordPress Plugin affecting all versions up to 2.7.2. The issue arises from missing or incorrect nonce validation on the plugin's settings update feature, enabling attackers to forge requests that update plugin settings without proper authorization. This can lead to unauthorized modification of sensitive plugin configuration, including private keys, if an administrator is tricked into executing the forged request.

An attacker can cause an authenticated site administrator to unknowingly update the plugin's settings via a forged request, potentially compromising sensitive configuration data such as private keys. This could weaken the security posture of the plugin and the WordPress site relying on it. However, there is no indication of direct confidentiality or availability impact beyond the integrity of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the WordPress or server level.