CVE-2025-8491 is a CSRF vulnerability in the Easy restaurant menu manager WordPress plugin by nikelschubert affecting all versions up to 2.0.2. The vulnerability arises from missing or incorrect nonce validation in the nsc_eprm_save_menu() function, enabling attackers to perform unauthorized menu file uploads if they can deceive an authenticated administrator into executing a crafted request. The vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows limited integrity impact (uploading unauthorized files).

An attacker can exploit this vulnerability to upload arbitrary menu files by tricking an authenticated administrator into clicking a malicious link or performing an action. This could lead to unauthorized content changes within the plugin but does not directly impact confidentiality or availability. The integrity of the menu data can be compromised, potentially affecting the website's displayed information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content while logged into WordPress with administrative privileges. Monitoring for plugin updates from nikelschubert is recommended to apply any forthcoming patches promptly.