CVE-2025-9630 is a CSRF vulnerability in the WP SinoType plugin for WordPress, affecting all versions up to 1.0. The issue arises from missing or incorrect nonce validation on the sinotype_config function, which is responsible for typography settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator, modifies plugin settings without their intent. The vulnerability requires user interaction (UI:R) and does not allow direct confidentiality or availability impact but can cause integrity loss of typography configuration.

An attacker can cause unauthorized changes to typography settings in the WP SinoType plugin by tricking an authenticated administrator into executing a malicious request. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing manual nonce validation or other CSRF protections in the plugin code could mitigate the risk if feasible.