CVE-2025-5932 describes a CSRF vulnerability in the Homerunner plugin for WordPress, affecting all versions up to and including 1.0.30. The root cause is missing or incorrect nonce validation in the main_settings() function, which enables attackers to submit forged requests that update plugin settings if a site administrator is tricked into interacting with a malicious link. This vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows integrity impact by modifying settings.

An attacker can cause a site administrator to unknowingly change plugin settings by exploiting the CSRF vulnerability. This could lead to unauthorized configuration changes within the Homerunner plugin, potentially affecting site behavior or security posture. There is no direct confidentiality or availability impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the Homerunner plugin settings. Implementing manual nonce validation or other CSRF protections at the application level may mitigate risk temporarily.