CVE-2025-9621

The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on the wpcmt_sync action in the wpcmt_request_handler function. This makes it possible for unauthenticated attackers to trigger comment synchronization events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L295
• https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L419
• https://www.wordfence.com/threat-intel/vulnerabilities/id/01996a4c-0ad8-4da8-bfa7-3442c5a67679?source=cve

Published

Oct 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9615A flaw was found in NetworkManager. The NetworkManager packa…3.3
• CVE-2025-9616The PopAd plugin for WordPress is vulnerable to Cross-Site R…5.3
• CVE-2025-9617The Publish approval plugin for WordPress is vulnerable to C…5.3
• CVE-2025-9618The Related Posts Lite plugin for WordPress is vulnerable to…4.3
• CVE-2025-9619A security flaw has been discovered in E4 Sistemas Mercatus …6.9
• CVE-2025-9620The Seo Monster plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2025-9622The WP Blast | SEO & Performance Booster plugin for WordPres…4.3
• CVE-2025-9623The Admin in English with Switch plugin for WordPress is vul…4.3
• CVE-2025-9624A vulnerability in OpenSearch allows attackers to cause Deni…7.5
• CVE-2025-9625The Coil Web Monetization plugin for WordPress is vulnerable…4.3
• CVE-2025-9626The Page Blocks plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-9627The Run Log plugin for WordPress is vulnerable to Cross-Site…4.3