CVE-2025-7688 is a Cross-Site Request Forgery vulnerability in the Add User Meta plugin for WordPress, affecting all versions up to and including 1.0.1. The issue arises from missing or incorrect nonce validation on the 'add-user-meta' page, enabling attackers to craft forged requests that, when executed by an authenticated site administrator, can update plugin settings and inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link, leading to unauthorized changes in plugin settings and potential injection of malicious scripts. This can compromise the confidentiality and integrity of the affected WordPress site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to the Add User Meta plugin, especially on the 'add-user-meta' page. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.