CVE-2025-12827

The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce validation on the top_friends_options_subpanel() function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/top-friends/tags/0.3/top-friends.php#L155
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8165196d-0117-473f-8ccf-57ffd3e08e16?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12821The NewsBlogger theme for WordPress is vulnerable to Cross-S…8.8
• CVE-2025-12822The WP Login and Register using JWT plugin for WordPress is …4.3
• CVE-2025-12823The CSV to SortTable plugin for WordPress is vulnerable to S…6.4
• CVE-2025-12824The Player Leaderboard plugin for WordPress is vulnerable to…8.8
• CVE-2025-12825The User Registration Using Contact Form 7 plugin for WordPr…5.3
• CVE-2025-12826The Custom Post Type UI plugin for WordPress is vulnerable t…4.8
• CVE-2025-12829An uninitialized stack read issue exists in Amazon Ion-C ver…6.9
• CVE-2025-1283The Dingtian DT-R0 Series is vulnerable to an exploit that a…9.8
• CVE-2025-12830The Better Elementor Addons plugin for WordPress is vulnerab…6.4
• CVE-2025-12832IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2025-12833The GeoDirectory – WP Business Directory Plugin and Classifi…4.3
• CVE-2025-12834The Accept Stripe Payments Using Contact Form 7 plugin for W…6.1