CVE-2025-6041 identifies a CSRF vulnerability in the yContributors plugin for WordPress, affecting all versions up to 0.5. The root cause is the absence or improper implementation of nonce validation on the plugin's settings page, which enables attackers to forge requests that an authenticated administrator might unwittingly execute. This can lead to unauthorized changes in plugin settings and potential injection of malicious web scripts. The vulnerability is remotely exploitable without authentication but requires user interaction (UI:R). The CVSS vector indicates low attack complexity and no privileges required, with partial confidentiality and integrity impact but no availability impact.

Successful exploitation allows an attacker to perform unauthorized actions on the yContributors plugin settings by leveraging a CSRF attack. This can result in partial compromise of confidentiality and integrity of the affected site through unauthorized settings changes and script injection. There is no direct impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should avoid interacting with untrusted links or pages while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.