CVE-2025-6059 is a CSRF vulnerability in the Seraphinite Accelerator WordPress plugin affecting all versions up to 2.27.21. The issue arises from missing or incorrect nonce validation in the 'OnAdminApi_CacheOpBegin' function, enabling attackers to perform administrative actions without authentication by exploiting the trust of a logged-in administrator. This vulnerability can lead to limited impact actions such as cache deletion. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the ease of attack (network vector, no privileges required, user interaction required) and limited impact (no confidentiality or availability impact, low integrity impact).

An attacker can cause an authenticated administrator to unknowingly execute administrative actions like cache deletion via a forged request. While this does not compromise confidentiality or availability, it can disrupt normal administrative operations and potentially affect site performance or behavior due to cache manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from SeraphiniteSoft regarding a security patch is recommended.