CVE-2025-5928 is a CSRF vulnerability in the WP Sliding Login/Dashboard Panel plugin for WordPress, affecting all versions up to 2.1.1. The vulnerability arises from missing or incorrect nonce validation in the wp_sliding_panel_user_options() function, enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires tricking an authenticated administrator into executing the malicious request. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause unauthorized changes to plugin settings by exploiting the CSRF vulnerability if an administrator is tricked into clicking a crafted link. This could lead to unauthorized configuration changes but does not directly impact confidentiality or availability. The integrity impact is low, and no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links and consider disabling or replacing the affected plugin. Implementing additional CSRF protections at the site level may help mitigate risk.