CVE-2025-9948 describes a CSRF vulnerability in the Chat by Chatwee WordPress plugin (versions up to 2.1.3). The issue arises from improper or absent nonce validation on the plugin's admin settings page, enabling attackers to perform unauthorized changes to plugin settings by leveraging an authenticated administrator's interaction with a crafted request. The vulnerability does not require privileges or direct authentication but depends on user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker can cause unauthorized modification of plugin settings by exploiting the CSRF vulnerability if they can trick an administrator into clicking a malicious link. This could lead to altered plugin behavior or configuration without the administrator's consent. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into the WordPress admin interface and consider implementing additional CSRF protections or restricting access to the plugin's settings page.