CVE-2025-9892 is a CSRF vulnerability in the devrix Restrict User Registration WordPress plugin affecting all versions up to 1.0.1. The issue arises from missing or incorrect nonce validation in the update() function, enabling attackers to forge requests that update plugin settings without proper authorization. Exploitation requires social engineering to convince an administrator to perform an action that triggers the malicious request. The vulnerability is network exploitable with low attack complexity and no privileges or user interaction required from the attacker, except the administrator being tricked.

Successful exploitation allows an unauthenticated attacker to alter the plugin's settings by leveraging a forged request executed by an administrator. This can lead to unauthorized changes in site configuration related to user registration controls, potentially weakening security or enabling further attacks. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links and consider implementing additional CSRF protections or disabling the plugin if feasible.