CVE-2025-9621 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WidgetPack Comment System WordPress plugin up to version 1.6.1. The issue stems from missing or incorrect nonce validation on the wpcmt_sync action handled by the wpcmt_request_handler function. This allows unauthenticated attackers to induce site administrators to perform unintended comment synchronization actions via crafted requests. The vulnerability is rated medium severity with a CVSS 3.1 score of 4.3, reflecting low complexity and no required privileges but requiring user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Exploitation of this vulnerability can lead to unauthorized triggering of comment synchronization events on affected WordPress sites using the WidgetPack Comment System plugin. While it does not directly compromise confidentiality or availability, it can lead to unintended changes in comment data integrity due to forged requests executed by an authenticated administrator. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger the vulnerable action. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.