CVE-2025-9618 describes a CSRF vulnerability in the Related Posts Lite plugin for WordPress (versions up to 1.12). The issue arises from missing or incorrect nonce validation on the settings update feature, enabling attackers to forge requests that modify plugin settings without authentication, relying on social engineering to trick administrators. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low complexity and no privileges required but requiring user interaction.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability if an administrator is tricked into clicking a crafted link. This could lead to altered plugin behavior or configuration, potentially impacting site functionality or security posture. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider restricting access to plugin settings to trusted users only. Monitoring for updates from the vendor or plugin author is recommended to apply an official fix once released.