CVE-2025-6055 describes a CSRF vulnerability in the Zen Sticky Social WordPress plugin (versions up to 0.3). The issue arises from improper or absent nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page, enabling attackers to craft forged requests that, if executed by an authenticated administrator, can modify plugin settings or inject malicious code. The vulnerability requires user interaction (UI:R) but no privileges or authentication (PR:N) to initiate the attack. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability to cause an authenticated site administrator to unknowingly perform actions that update plugin settings or inject malicious scripts. This can lead to partial compromise of site integrity and confidentiality. However, the attack requires tricking an administrator into interacting with a malicious request, and there is no direct availability impact. No known exploits are currently reported in the wild.

No official patch or fix is currently available for this vulnerability. Users of the Zen Sticky Social plugin should monitor the vendor's communications for updates and apply any future patches promptly. Until a fix is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin actions. Consider disabling or removing the plugin if it is not essential to reduce exposure.