CVE-2025-9631 is a CSRF vulnerability in the gyaku AutoCatSet WordPress plugin affecting all versions up to 2.1.4. The vulnerability arises from missing or incorrect nonce validation in the autocatset_ajax function, enabling attackers to forge requests that trigger automatic post recategorization when a site administrator interacts with a crafted link. The vulnerability requires user interaction (UI:R) and does not require privileges (PR:N). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and limited impact on integrity only.

An attacker can cause unauthorized automatic recategorization of posts by tricking an administrator into clicking a malicious link. This impacts the integrity of post categorization but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or restricting the AutoCatSet plugin functionality that triggers the autocatset_ajax action.