CVE-2025-3870 identifies a CSRF vulnerability in the 1 Decembrie 1918 WordPress plugin by olarmarius. The issue arises from missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page, enabling unauthenticated attackers to perform actions such as updating plugin settings and injecting malicious web scripts if they can deceive a site administrator into clicking a crafted link. This vulnerability is categorized under CWE-79, indicating improper input neutralization leading to cross-site scripting risks. The CVSS score of 6.1 reflects a medium impact with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact. No patch or official remediation is currently documented.

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an administrator, including injecting malicious scripts into the website. This can lead to partial compromise of confidentiality and integrity of the affected site. There is no indication of availability impact. The vulnerability requires user interaction (administrator clicking a malicious link) and does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking suspicious links and consider disabling or removing the vulnerable plugin. Implementing additional CSRF protections or nonce validations manually may help mitigate risk but should be done cautiously. Monitor vendor channels for updates or patches.