CVE-2025-4189 describes a CSRF vulnerability in the naicuoctavian Audio Comments Plugin for WordPress, affecting all versions up to 1.0.4. The issue arises from missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page, which enables unauthenticated attackers to forge requests that update plugin settings or inject malicious web scripts if a site administrator is tricked into clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability by tricking a WordPress site administrator into performing an action via a forged request, potentially leading to unauthorized changes in plugin settings and injection of malicious scripts. This can compromise the integrity and confidentiality of the affected site. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch is documented. Administrators should monitor the vendor's advisory channels for updates. Until a patch is available, limiting administrator exposure to untrusted links and employing web application firewalls that can detect CSRF attempts may help reduce risk.