CVE-2025-9945 is a CSRF vulnerability in the Optimize More! – CSS WordPress plugin (versions up to 1.0.3). The issue arises from missing or incorrect nonce validation on the reset_plugin function, which controls resetting optimization settings. An attacker can exploit this by crafting a malicious request that, when performed by an authenticated site administrator (e.g., clicking a link), resets the plugin's settings without proper authorization. This vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized changes to plugin settings.

The vulnerability allows an attacker to cause an authenticated administrator to unknowingly reset the plugin's optimization settings. This could disrupt site performance or configuration but does not lead to data disclosure or denial of service. The impact is limited to integrity of plugin settings with no direct effect on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Implementing nonce validation or other CSRF protections in the plugin code is necessary to fully mitigate this issue once a patch is released.