CVE-2025-6040 affects the Easy Flashcards plugin for WordPress, specifically versions up to and including 0. The vulnerability arises from missing or incorrect nonce validation on the 'ef_settings_submenu' administrative page, enabling Cross-Site Request Forgery attacks. An attacker can exploit this by tricking an authenticated site administrator into submitting a crafted request, which can update plugin settings and inject malicious web scripts. This vulnerability is categorized under CWE-79, reflecting improper neutralization of input leading to Cross-site Scripting. The CVSS 3.1 score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. There is no vendor advisory or patch available at this time.

Successful exploitation allows an unauthenticated attacker to perform unauthorized changes to the plugin settings by leveraging a site administrator's interaction, potentially injecting malicious scripts into the web application. This can lead to partial compromise of confidentiality and integrity of the affected site. Availability is not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links or requests that could trigger changes in the Easy Flashcards plugin settings. Monitoring for suspicious administrator activity and restricting administrative access may reduce risk. Do not rely on generic mitigations; focus on vendor updates.