PT-2025-41680 · WordPress · Widgetpack Comment System

Claw.K + 1 · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-9621

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WidgetPack Comment System versions prior to 1.6.2

Description The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpcmt sync action within the wpcmt request handler function. This allows unauthenticated attackers to trigger comment synchronization events through a forged request if they can trick a site administrator into performing an action, such as clicking a link.

Recommendations Update WidgetPack Comment System to version 1.6.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9621

Affected Products

Widgetpack Comment System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9621 · Security Note
• https://twitter.com/CVEnew/status/1976948528321904742 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/01996a4c-0ad8-4da8-bfa7-3442c5a67679?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1977024488836407592 · Twitter Post
• https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L419 · Note
• https://t.me/CVEtracker/34673 · Telegram Post
• https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L295 · Note