CVE-2025-1463 is a CSRF vulnerability in the WPGSI: Spreadsheet Integration WordPress plugin caused by improper nonce validation in the class-wpgsi-show.php script. This allows attackers to craft malicious requests that, when executed by an authenticated site administrator, can result in publishing arbitrary posts without the administrator's explicit intent. The vulnerability affects all versions up to and including 3.8.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, but requiring user interaction.

An attacker can cause a site administrator to unknowingly publish arbitrary posts, including private posts, potentially leading to unauthorized content disclosure or manipulation. There is no indication of direct confidentiality or availability impact beyond the integrity of published content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid clicking on untrusted links and consider disabling or restricting the use of the WPGSI plugin. Implementing additional CSRF protections or nonce validation checks may mitigate the risk.