CVE-2025-15376 describes a CSRF vulnerability in the Stopwords for comments plugin for WordPress by rndsand81. The issue arises because the plugin lacks nonce validation on the 'set_stopwords_for_comments' and 'delete_stopwords_for_comments' functions, enabling attackers to perform unauthorized modifications to stopwords by exploiting an authenticated administrator's session through a crafted request. This vulnerability affects all versions up to and including 1.1.

An attacker can cause an authenticated site administrator to unknowingly add or delete stopwords by tricking them into clicking a malicious link or visiting a crafted page. This could affect the behavior of comment filtering but does not directly compromise confidentiality or availability. The impact is limited to integrity of stopwords configuration with no direct code execution or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.