CVE-2025-7839 identifies a CSRF vulnerability in the WordPress plugin 'Restore Permanently delete Post or Page Data' (versions up to 1.0). The issue arises from missing or incorrect nonce validation in the rp_dpo_dpa_ajax_dp_delete_data() function, which is intended to protect against unauthorized requests. Because of this, an attacker can craft a forged request that, if executed by an authenticated site administrator, results in deletion of post or page data. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) or local access, and it affects the integrity of data (I:L) without impacting confidentiality or availability.

An attacker who successfully exploits this vulnerability can cause unauthorized deletion of post or page data on a vulnerable WordPress site by tricking an administrator into performing an action such as clicking a crafted link. This impacts data integrity but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, administrators should monitor for updates from the plugin developer. Until a fix is available, limiting administrator exposure to untrusted content and avoiding clicking suspicious links can reduce risk.