CVE-2025-5930 is a CSRF vulnerability in the WP2HTML plugin for WordPress, affecting all versions up to and including 1.0.2. The issue arises from missing or incorrect nonce validation in the save() function, which is intended to protect against unauthorized requests. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., via clicking a link), results in unauthorized modification of plugin settings. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting low complexity and requiring user interaction but no privileges.

Successful exploitation allows an attacker to update WP2HTML plugin settings without authentication, potentially leading to unauthorized configuration changes. There is no direct confidentiality or availability impact reported. The attack requires tricking an administrator into performing an action, such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended.