CVE-2025-54042

The WP Post Hide plugin for WordPress versions up to 1.0.9 contains a Cross-Site Request Forgery (CSRF) vulnerability [1]. This flaw occurs because the plugin fails to validate or verify the origin of requests made to its administrative functions, allowing attackers to craft malicious links or forms that, when visited by an authenticated administrator, can execute unwanted actions under the administrator's session [1].

To exploit this vulnerability, an attacker must trick a logged-in user with administrative privileges into clicking a crafted link or visiting a malicious page. No direct authentication is required for the attacker, but the victim must be authenticated to the WordPress site [1]. The attack can be initiated remotely, and the attacker does not need any special privileges beforehand.

If successfully exploited, the attacker can force the victim to perform actions such as changing plugin settings, modifying posts, or other administrative tasks without the user's knowledge [1]. The impact is limited by the privileges of the victim, but the vulnerability is considered medium severity with a CVSS v3 score of 4.3 [1]. The vendor has released version 1.1.0 which addresses the issue; users are advised to update immediately or enable auto-updates [1].