CVE-2025-5933 is a CSRF vulnerability in the RD Contacto plugin for WordPress affecting all versions up to 1.4. The vulnerability arises from missing or incorrect nonce validation on the rdWappUpdateData() function, enabling attackers to perform unauthorized updates to plugin settings by leveraging an authenticated administrator's interaction with a crafted request. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in limited impact to integrity without affecting confidentiality or availability.

An attacker can cause an authenticated site administrator to unknowingly update plugin settings via a forged request, potentially altering plugin behavior or configuration. There is no direct impact on confidentiality or availability reported. The integrity of plugin settings is at risk, which could lead to further indirect security issues depending on the changes made.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.