CVE-2025-7835 describes a CSRF vulnerability in the iThoughts Advanced Code Editor WordPress plugin (versions up to 1.2.10). The issue arises from missing or incorrect nonce validation on the 'ithoughts_ace_update_options' AJAX action, enabling attackers to forge requests that update plugin settings without authentication if an administrator is tricked into executing the request. This vulnerability is classified under CWE-352 and has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no indication of known exploits in the wild or an official patch at this time.

An attacker can cause an authenticated administrator to unknowingly update plugin settings via a forged request, potentially altering plugin behavior or configuration. The vulnerability does not directly impact confidentiality or availability but can lead to integrity issues within the plugin's settings. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution by limiting plugin usage to trusted users and avoiding clicking untrusted links while logged in as an administrator. Monitoring for updates from the vendor is recommended.