WidgetPack Comment System CVE-2025-9621

Exploitation requires an attacker to trick a currently logged-in WordPress site administrator into performing an action such as clicking a crafted link or visiting a malicious page (UI:R), because the wpcmt_sync action in the wpcmt_request_handler function lacks valid nonce verification. The attacker needs no credentials of their own, but the forged request executes within the victim admin's authenticated session. Exploitation is limited by: the dependence on social engineering of a privileged user, the fact that the only reachable effect is triggering a comment synchronization event (integrity-only, no data disclosure or service disruption), and the requirement that the target run WidgetPack Comment System ≤1.6.1.

This is a low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3 Medium) shows the only path is a forged cross-site request (CWE-352) that requires user interaction (UI:R) from an authenticated administrator, and the impact is limited to integrity alone (I:L) - triggering comment synchronization - with no confidentiality or availability impact. All exploitation signals point to low real-world urgency: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced. No SSVC decision data was provided. The 'unauthenticated attacker' label refers to the attacker's own lack of credentials; exploitation still depends on an already-authenticated admin being socially engineered into clicking a link, which substantially narrows practical exploitability. No signals conflict here - low EPSS, no KEV, no POC, and a constrained CSRF-with-UI vector are all mutually consistent in indicating this is a genuinely low-risk, low-impact issue rather than a high-CVSS-but-overrated one.

An attacker crafts a malicious web page or email link containing a forged request to the vulnerable wpcmt_sync action. When a logged-in WordPress administrator is tricked into visiting the page or clicking the link, their browser silently submits the request and triggers an unintended comment synchronization event on the site. No public exploit code is identified, and the attack succeeds only against an authenticated admin who takes the bait.