CVE-2025-9628 describes a CSRF vulnerability in the AMO.CRM WordPress plugin integration by jh5ru. The issue arises from missing or incorrect nonce validation in the settings_page function, which handles critical API connection settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator, modifies sensitive configuration parameters such as the API URL, login credentials, and API hash key. This vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction.

Successful exploitation allows an attacker to alter critical API connection settings of the AMO.CRM plugin without authentication, potentially disrupting integration functionality or enabling further attacks through manipulated credentials. There is no direct confidentiality or availability impact reported, but integrity of API settings is compromised. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider restricting access to the plugin settings page. Monitoring for suspicious changes to API connection settings is recommended.