The Bulk Term Editor plugin by Yuya Hoshino, versions up to 1.1.4, contains a CSRF vulnerability (CVE-2025-39512). This vulnerability enables attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation mechanisms. The vulnerability does not directly impact confidentiality or availability but can lead to unauthorized modification of data (integrity impact). The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction.

The vulnerability allows an attacker to cause an authenticated user to perform unintended actions within the Bulk Term Editor plugin, potentially leading to unauthorized changes (integrity impact). There is no impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users. Monitoring vendor communications for updates is recommended.