CVE-2025-9632: PhpList Subber <= 1.1 - Cross-Site Request Forgery
The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulkactionhandler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9632?
CVE-2025-9632 is classified as a moderate severity vulnerability due to its potential to allow unauthorized actions through Cross-Site Request Forgery.
How do I fix CVE-2025-9632?
To fix CVE-2025-9632, update the PhpList Subber plugin to version 1.2 or later, which addresses the nonce validation issue.
Who is affected by CVE-2025-9632?
Any WordPress site using the PhpList Subber plugin version 1.1 or earlier is affected by CVE-2025-9632.
What kind of attack does CVE-2025-9632 allow?
CVE-2025-9632 allows unauthenticated attackers to perform unauthorized actions via Cross-Site Request Forgery.
Is CVE-2025-9632 a known issue in previous versions of the plugin?
Yes, CVE-2025-9632 affects all versions of the PhpList Subber plugin up to and including version 1.1.