CVE-2025-9622 is a CSRF vulnerability in the WP Blast | SEO & Performance Booster WordPress plugin affecting all versions up to 1.8.6. The issue arises from missing or incorrect nonce validation in the Settings class, which governs administrative actions. An attacker can exploit this by crafting forged requests that, if an administrator executes (e.g., by clicking a link), trigger sensitive operations such as cache purging and sitemap clearing without proper authorization checks.

The vulnerability allows unauthorized triggering of administrative functions like cache purging, sitemap clearing, plugin data purging, and score resetting. While it does not directly expose confidential data or allow code execution, it can disrupt site performance and integrity by manipulating plugin settings and data. The CVSS score of 4.3 reflects limited impact primarily on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access to trusted networks or users. Monitoring for suspicious administrative actions may help detect exploitation attempts.