CVE-2025-32281

The DarkMySite plugin for WordPress versions through 1.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability. The plugin fails to properly validate or verify nonce tokens in certain requests, allowing attackers to trick authenticated users into performing unintended actions.

Exploitation requires user interaction—an attacker must convince a privileged user (e.g., an administrator) to click a malicious link, visit a crafted page, or submit a form while logged into the WordPress site. No authentication is required for the attacker, but the victim must have an active session with sufficient privileges.

Successful CSRF attacks can force the victim to modify plugin settings, deactivate the plugin, or perform other actions under their current authentication, potentially leading to unauthorized changes. The impact is considered low severity as it relies on user interaction and does not directly lead to data breaches or privilege escalation.

Mitigation is available: users should update to version 1.2.9 or later, which resolves the issue. Patchstack users can enable auto-updates for vulnerable plugins. No workaround is mentioned, but updating is strongly recommended [1].