CVE-2025-13657 is a CSRF vulnerability affecting the HelpDesk Contact Form WordPress plugin through version 1.1.5. The issue is caused by missing or incorrect nonce validation in the handle_query_args() function, which allows unauthenticated attackers to modify sensitive plugin settings by leveraging an administrator's interaction with a crafted request. This vulnerability does not require privileges but does require user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause unauthorized changes to the plugin's license ID and contact form ID settings by tricking an administrator into clicking a malicious link. This could lead to potential misconfiguration or misuse of the plugin settings. There is no direct confidentiality or availability impact reported, and no known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links and consider disabling or restricting access to the affected plugin settings. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any forthcoming patches promptly.