CVE-2025-5925 is a Cross-Site Request Forgery vulnerability in the Bunny’s Print CSS WordPress plugin (up to version 0.95). The issue arises from missing or incorrect nonce validation in the pcss_options_subpanel() function, enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires social engineering to trick an authenticated site administrator into executing the malicious request. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). No known exploits are reported in the wild, and no patch or remediation details have been provided.

An attacker can cause unauthorized changes to the plugin’s settings by exploiting the CSRF vulnerability if they can convince an administrator to perform an action such as clicking a crafted link. This may lead to limited integrity impact on the affected site’s configuration. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.