CVE-2025-9618: 
WordPress vulnerability analysis and mitigation

The Related Posts Lite plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2025-9618) discovered on August 29, 2025. This vulnerability affects all versions up to and including 1.12 (NVD Database, AttackerKB).

The vulnerability stems from missing or incorrect nonce validation on the settings update functionality. The CVSS v3.1 base score is 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability requires network access and user interaction, but no privileges, and can result in low impact to integrity (NVD Database).

If exploited, the vulnerability allows unauthenticated attackers to modify plugin settings through forged requests. The impact is limited to plugin configuration changes, which can only occur if a site administrator is tricked into performing specific actions like clicking on a malicious link (NVD Database).

Site administrators should update the Related Posts Lite plugin to a version newer than 1.12 when available. Until then, administrators should exercise caution when clicking on links while logged into their WordPress dashboard (NVD Database).