CVE-2025-9885 is a Cross-Site Request Forgery vulnerability in the MPWizard – Create Mercado Pago Payment Links WordPress plugin, affecting all versions up to and including 1.2.1. The issue arises from missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file, enabling attackers to perform unauthorized actions like deleting posts if an administrator is tricked into clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no privileges required but requiring user interaction.

An attacker can cause an authenticated site administrator to unknowingly perform actions such as deleting arbitrary posts by exploiting the CSRF vulnerability. This can lead to unauthorized content deletion, impacting site integrity and availability. There is no indication of confidentiality or availability impact beyond the deletion of posts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should exercise caution when clicking on links, especially from untrusted sources. Implementing additional CSRF protections or disabling the plugin if not in use may reduce risk.