CVE-2025-49964

The ClipLink plugin for WordPress, up to version 1.1, contains a Cross-Site Request Forgery (CSRF) vulnerability. This lack of CSRF token validation allows an attacker to craft requests that, when triggered by a privileged user (like an administrator), perform unintended actions on their behalf [1].

Exploitation requires user interaction—an admin must click a malicious link or visit a crafted page while authenticated. No authentication is needed for the attacker, only for the victim user whose session is abused. The vulnerability is classified under CSRF and has a CVSS score of 4.3 (Medium) [1].

A successful CSRF attack can force the victim to change settings, modify content, or perform other admin-level operations without their consent. This type of vulnerability is frequently targeted in mass-exploit campaigns across thousands of sites [1].

The vendor has not released a patch, but immediate action is recommended: update the plugin if a fix becomes available, or contact a hosting provider for assistance. As of the advisory, no workaround is provided beyond restricting access to the vulnerable functionality [1].