CVE-2025-1530 is a Cross-Site Request Forgery vulnerability in the Tripetto WordPress form builder plugin. Due to missing nonce validation, attackers can craft forged requests that, when executed by an authenticated administrator (e.g., via clicking a link), allow deletion of arbitrary form results. This affects all versions up to and including 8.0.9. The vulnerability does not require privileges or direct user interaction beyond tricking an admin to click a link. The CVSS 3.1 base score is 4.3, reflecting low complexity but limited impact (integrity loss without confidentiality or availability impact).

An attacker can cause an authenticated administrator to unknowingly delete arbitrary form results by exploiting the CSRF vulnerability. This results in integrity loss of stored data within the Tripetto plugin. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider restricting administrative access or implementing additional CSRF protections at the WordPress or server level. Monitor vendor channels for updates and apply patches promptly once released.