CVE-2025-7686 is a Cross-Site Request Forgery vulnerability in the weichuncai (WP伪春菜) WordPress plugin, affecting all versions up to 1.5. The issue arises from missing or incorrect nonce validation on the sm-options.php page, which is intended to protect against unauthorized state-changing requests. An attacker can exploit this by tricking an authenticated site administrator into submitting a forged request, enabling the attacker to update plugin settings and inject malicious web scripts. The vulnerability has a CVSS 3.1 score of 6.1, reflecting a medium impact on confidentiality and integrity but no impact on availability. There are no known exploits in the wild and no vendor-provided patch or advisory at this time.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and inject malicious scripts by leveraging an administrator's authenticated session. This can lead to partial compromise of site confidentiality and integrity. Availability is not affected. The vulnerability requires user interaction (administrator clicking a crafted link) and network access. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links and consider disabling or removing the plugin if possible. Monitoring for suspicious changes in plugin settings may help detect exploitation attempts.