CVE-2025-0796

Summary

CVE-2025-0796 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Mortgage Lead Capture System plugin for WordPress. Versions up to and including 8.2.10 are vulnerable due to lax nonce validation on the 'wprequal_reset_defaults' action. Attackers can exploit this flaw by crafting malicious requests that, when clicked by a site administrator, would reset the plugin's settings. The vulnerability could lead to unintended configurations and potential security risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.