PT-2025-38636 · WordPress · Custom Login/Signup Widget

Joseph Kanko · Published 2025-09-20 · Updated 2025-09-20 · CVE-2025-9887

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Login And Signup Widget versions prior to 1.0

Description The Custom Login And Signup Widget plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the /frndzk adminclsw.php file. This allows unauthenticated attackers to modify email and username settings through a forged request if they can trick a site administrator into performing an action.

Recommendations Update the Custom Login And Signup Widget plugin to a version newer than 1.0.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9887

Affected Products

Custom Login/Signup Widget

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-9887 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f478db7f-6339-446e-b00d-0710707e679a?source=cve · Note
• https://t.me/CVEtracker/32995 · Telegram Post
• https://plugins.trac.wordpress.org/browser/custom-login-and-signup-widget/tags/1.0/frndzk_adminclsw.php#L3 · Note