CVE-2025-9899 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Trust Reviews plugin for WordPress (versions up to 1.0). The issue stems from missing or incorrect nonce validation in the feed_save function, which is responsible for saving feed entries. Because of this, an attacker can craft a malicious request that, if executed by an authenticated site administrator (e.g., by clicking a link), can create or modify feed entries without proper authorization. The vulnerability is remotely exploitable without prior authentication but requires user interaction. The CVSS v3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker to create or modify feed entries in the Trust Reviews plugin without authentication, by tricking an administrator into performing an action. This can lead to unauthorized content changes affecting the integrity and confidentiality of the review feeds displayed on the site. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links or performing actions from untrusted sources that could trigger the vulnerable feed_save function. Monitoring for plugin updates and applying them promptly once released is recommended.