CVE-2025-9893 is a CSRF vulnerability in the VM Menu Reorder WordPress plugin (versions up to 1.0.0). The issue stems from improper or absent nonce validation on the vm_set_to_default function, allowing an attacker to force a site administrator to reset menu reorder settings via a forged request. The vulnerability does not require privileges or authentication but depends on user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

Successful exploitation allows an unauthenticated attacker to reset all menu reordering settings on a vulnerable WordPress site if an administrator is tricked into performing an action such as clicking a crafted link. This results in low integrity impact but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should exercise caution with links and requests related to menu reordering functions and consider implementing manual nonce validation or other CSRF protections if possible.