CVE-2025-9882

Vulnerability

Overview The osTicket WP Bridge plugin for WordPress, in all versions up to and including 1.9.2, is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on a function. This flaw allows an attacker to perform unauthorized actions on behalf of a site administrator [1].

Exploitation

Conditions An unauthenticated attacker can craft a malicious request to update plugin settings and inject malicious web scripts (XSS). The attack requires tricking a logged-in administrator into performing an action, such as clicking a link, which then executes the forged request [1].

Impact

Successful exploitation enables the attacker to modify critical plugin settings and inject arbitrary JavaScript or HTML, potentially leading to further compromise of the WordPress site or its users [1].

Mitigation

Status The plugin has been closed as of September 17, 2025, due to the security issue [1]. Users are advised to immediately remove the plugin and seek alternative solutions, as no patched version is available.