CVE-2025-9626 is a CSRF vulnerability in the softwud Page Blocks WordPress plugin affecting all versions up to 1.1.0. The issue stems from inadequate nonce validation in the admin_process_widget_page_change function, allowing unauthenticated attackers to modify widget page block settings by tricking an administrator into submitting a forged request. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, but user interaction needed. No patch or vendor advisory is currently available.

Successful exploitation allows an attacker to modify widget page block configurations on a vulnerable WordPress site by leveraging an authenticated administrator's actions. This can lead to unauthorized changes in the site's widget layout or content blocks. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress admin interfaces. Monitoring for updates from the vendor or plugin maintainers is recommended.