CVE-2025-13521 is a CSRF vulnerability in the WP Status Notifier plugin for WordPress, affecting all versions up to and including 1.0. The issue arises from missing or incorrect nonce validation on the plugin's settings update feature, enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires tricking an authenticated site administrator into performing an action such as clicking a crafted link. The vulnerability is rated medium severity with a CVSS score of 4.3 and does not impact confidentiality or availability, only integrity to a limited extent.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability, potentially altering site behavior or configuration. There is no direct impact on confidentiality or availability. The attack requires user interaction from an administrator, limiting the ease of exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider restricting administrative access or using additional CSRF protections at the WordPress or server level. Monitor official fulippo or WordPress plugin sources for updates addressing this vulnerability.