CVE-2025-9634 is a CSRF vulnerability in the jegerwan Plugin updates blocker WordPress plugin affecting all versions up to and including 0.2. The issue arises because the plugin's pub_save action handler lacks proper nonce validation, enabling attackers to perform unauthorized state-changing actions by convincing an administrator to execute a crafted request. This can result in enabling or disabling plugin updates without the administrator's explicit intent.

An attacker can cause a site administrator to unknowingly enable or disable plugin updates, potentially affecting the site's update management process. The vulnerability does not directly impact confidentiality or availability but can lead to integrity issues by altering plugin update settings without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress admin interface. Monitoring for updates from the vendor is recommended.