CVE-2025-9635 is a CSRF vulnerability in the Analytics Reduce Bounce Rate plugin for WordPress, affecting all versions up to 2.3. The vulnerability arises from missing or incorrect nonce validation on the unbounce_options function, enabling attackers to forge requests that modify Google Analytics tracking settings if a site administrator is tricked into executing the action. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact is limited to integrity with no confidentiality or availability impact. There is no vendor advisory or patch information available at this time.

An attacker can cause unauthorized changes to Google Analytics tracking settings by exploiting the CSRF vulnerability if they can trick an authenticated site administrator into clicking a crafted link. This results in limited integrity impact on the plugin's configuration but does not affect confidentiality or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring vendor channels for updates is recommended.