CVE-2025-15377 identifies a CSRF vulnerability in the abage Sosh Share Buttons WordPress plugin. The issue arises from the absence of nonce validation in the 'admin_page_content' function, which is responsible for handling plugin settings updates. Because of this, attackers can craft forged requests that, when executed by an authenticated administrator (e.g., via clicking a link), can modify plugin settings without proper authorization. The vulnerability affects all versions up to and including 1.1.0. There is no evidence of known exploits in the wild, and no patch or official remediation has been published as of the data available.

An attacker can cause an authenticated site administrator to unknowingly change the plugin's settings by exploiting the CSRF vulnerability. This could lead to unauthorized configuration changes, potentially impacting site behavior or security posture. However, the vulnerability does not allow direct code execution, data disclosure, or denial of service. The impact is limited to integrity of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to the plugin's admin interface. Applying general best practices such as limiting administrator access and avoiding clicking untrusted links can reduce risk. Monitor the vendor's channels for updates or patches addressing this vulnerability.