CVE-2026-8425 is a CSRF vulnerability in the Notify Odoo WordPress plugin (versions up to 1.0.1) caused by missing or incorrect nonce validation on the _updateSettings function. This flaw enables attackers to forge requests that, when executed by an authenticated site administrator, can alter critical plugin settings including the Notify Odoo URL, notification parameters, tracking images, and allowed IP addresses. The vulnerability does not require privileges or direct user interaction beyond tricking an admin to click a crafted link. The CVSS score of 4.3 reflects low complexity and no confidentiality or availability impact but a limited integrity impact.

An attacker can modify Notify Odoo plugin settings without authentication by exploiting the CSRF vulnerability, potentially redirecting notifications or tracking to attacker-controlled endpoints and changing allowed IP addresses. This could undermine the integrity of notification and tracking functions but does not directly impact confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress and consider disabling or removing the Notify Odoo plugin if possible. Monitoring for updates from the vendor is recommended.