CVE-2025-23900: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Genkisan Genki Announcement WordPress plugin affecting versions through 1.4.1. The vulnerability was disclosed on January 16, 2025, and assigned identifier CVE-2025-23900. The issue allows unauthenticated attackers to perform Cross Site Request Forgery attacks (Patchstack, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue stems from missing or incorrect nonce validation on a function, which could allow attackers to update settings and inject malicious web scripts via forged requests if they can trick a site administrator into performing specific actions (WPScan).

The vulnerability could allow unauthenticated attackers to force higher privileged users to execute unwanted actions under their current authentication. This could potentially lead to stored cross-site scripting attacks if successfully exploited (Patchstack).

The vulnerability requires user interaction, specifically tricking a site administrator into clicking on a malicious link. The attack can be initiated by an unauthenticated attacker remotely (WPScan).

As of the disclosure date, there is no official fix available for this vulnerability. The issue affects all versions up to and including version 1.4.1 (Patchstack).