CVE-2025-9889 is a CSRF vulnerability in the ContentMX Content Publisher WordPress plugin affecting all versions up to 1.0.6. The issue arises from missing or incorrect nonce validation on the cmx_activate_connection function, enabling attackers to forge requests that bind unauthorized ContentMX connections if an administrator is tricked into executing the action. The vulnerability requires user interaction (UI:R) and has no direct confidentiality or availability impact, but it can cause limited integrity impact by allowing unauthorized binding of connections.

An attacker can cause a site administrator to unknowingly bind an attacker-controlled ContentMX connection via a forged request. This may lead to unauthorized actions within the plugin context, impacting the integrity of the site’s ContentMX connections. There is no direct impact on confidentiality or availability. No known exploits have been reported in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the WordPress or server level to mitigate risk.