CVE-2025-6781: Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update
The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymaticapikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the plugin 'copymatic-menu' page properly validates a nonce for requests that update the copymatic_apikey option; fix missing/incorrect nonce validation so forged CSRF requests cannot update copymatic_apikey.
WordPress Copymatic – AI Content Writer & Generator plugin copymatic-menu nonce validation = correct/valid nonce required for requests that update settings (copymatic-menu page) - Compensating control
Use CSRF protections on the WordPress side (e.g., ensure only requests with valid nonces can update plugin settings) so attackers cannot trick an administrator into submitting forged requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6781?
CVE-2025-6781 is classified as a medium-severity vulnerability due to its potential for exploitation via Cross-Site Request Forgery.
How do I fix CVE-2025-6781?
To fix CVE-2025-6781, update the Copymatic plugin to version 2.2 or later where the nonce validation issue is addressed.
Who is affected by CVE-2025-6781?
CVE-2025-6781 affects all versions of the Copymatic – AI Content Writer & Generator plugin up to and including version 2.1.
What type of vulnerability is CVE-2025-6781?
CVE-2025-6781 is a Cross-Site Request Forgery vulnerability that allows attackers to perform unauthorized actions.
Can CVE-2025-6781 be exploited by unauthenticated users?
Yes, CVE-2025-6781 can be exploited by unauthenticated users due to the lack of proper nonce validation.