CVE-2025-9888 is a CSRF vulnerability in the Maspik – Ultimate Spam Protection plugin for WordPress, affecting all versions up to 2.5.6. The issue arises from missing or incorrect nonce validation on the clear_log function, enabling attackers to forge requests that clear spam logs when an administrator interacts with a crafted link. The vulnerability does not require privileges or direct user interaction beyond tricking an admin to click a link. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can clear all spam logs by exploiting this CSRF vulnerability, potentially hindering the site administrator's ability to track spam activity. There is no direct confidentiality or availability impact reported. The integrity impact is low as only spam logs are affected, not core data or system functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the vulnerable clear_log function if possible may reduce risk.