CVE-2025-9632 is a CSRF vulnerability in the PhpList Subber WordPress plugin (versions up to 1.1). The issue stems from inadequate nonce validation in the bulk_action_handler function, allowing attackers to forge requests that cause bulk synchronization of subscription forms when an administrator is tricked into interacting with a malicious link. This vulnerability does not require privileges or authentication but does require user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting low complexity and limited impact on confidentiality and availability.

Successful exploitation allows an attacker to cause a site administrator to unknowingly trigger bulk synchronization of subscription forms. This could lead to unintended changes or actions within the plugin's subscription management but does not directly impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the WordPress or server level.