CVE-2025-4194 describes a CSRF vulnerability in the AlT Monitoring plugin for WordPress, affecting all versions up to and including 1.0.3. The root cause is missing or incorrect nonce validation on the 'ALT_Monitoring_edit' page, which enables attackers to forge requests that an authenticated administrator might unknowingly execute. This can lead to unauthorized changes in plugin settings and injection of malicious web scripts. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

Successful exploitation allows an attacker to update plugin settings and inject malicious scripts by tricking an administrator into performing an action such as clicking a crafted link. This can lead to limited confidentiality and integrity impacts on the affected WordPress site. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with unsolicited links and consider restricting administrative access or using additional CSRF protection mechanisms. Monitor official alti5 communications for updates on patches or mitigations.