CVE-2025-3097 describes a Cross-Site Request Forgery vulnerability in the wp Time Machine WordPress plugin (versions up to 3.4.0). The issue arises from missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page, enabling unauthenticated attackers to craft forged requests that, if executed by an administrator, can update plugin settings and inject malicious web scripts. This vulnerability is categorized under CWE-79, indicating improper input neutralization leading to cross-site scripting risks. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts on confidentiality and integrity with scope changed.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and inject malicious scripts by tricking an administrator into executing a crafted request. This can lead to partial compromise of site confidentiality and integrity, potentially enabling further attacks or unauthorized data access. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger wp Time Machine plugin actions. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.