CVE-2025-9374 describes a CSRF vulnerability in the Ultimate Tag Warrior Importer WordPress plugin (versions up to 0.2). The issue arises from missing or incorrect nonce validation on a function responsible for importing tags. Because of this, attackers can exploit the vulnerability by convincing an authenticated site administrator to execute an unwanted action, such as importing tags, without their explicit consent. The vulnerability does not require privileges or authentication beyond tricking an admin user to interact with a malicious link. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker can cause a site administrator to unknowingly import tags into the WordPress site by exploiting the CSRF vulnerability. This could lead to unauthorized modifications of site content or metadata related to tags. There is no direct impact on confidentiality or availability, and the integrity impact is low. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor for updates from the plugin vendor or WordPress plugin repository. As a temporary mitigation, restricting administrative access and avoiding clicking untrusted links while logged in as an administrator may reduce risk.