Description
The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-07-18
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized configuration change via CSRF
Action: Apply Patch
AI Analysis

Impact

The Copymatic – AI Content Writer & Generator plugin for WordPress contains a Cross‑Site Request Forgery flaw that bypasses nonce validation on the settings page. A forged request can alter the copymatic_apikey option without authentication, allowing an attacker to compromise the API key used for content generation. This vulnerability is identified as a CWE‑352 type flaw with a CVSS score of 4.3, indicating low‑to‑medium severity.

Affected Systems

All versions of the Copymatic – AI Content Writer & Generator plugin from ryanfaber up to and including 2.1 are affected. Administrators using these releases should verify the installed version and apply fixes when available.

Risk and Exploitability

The flaw offers a low‑probability attack vector that requires only an unauthenticated attacker to lure a site administrator into clicking a forged link. Because the EPSS score is below 1 % and the vulnerability is not listed in CISA's KEV catalog, the likelihood of widespread exploitation is currently low. Nonetheless, the potential to compromise the API key warrants prompt attention.

Generated by OpenCVE AI on April 20, 2026 at 22:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Copymatic to a version newer than 2.1 where the nonce check is properly implemented.
  • If an update is not immediately feasible, restrict access to the settings page or temporarily disable the copymatic_apikey option to prevent unauthorized changes.
  • Verify that nonce validation is present on all future settings changes and consider adding an additional verification layer such as checking user capabilities or implementing a custom CSRF token.

Generated by OpenCVE AI on April 20, 2026 at 22:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-21837 The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
History

Fri, 18 Jul 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Jul 2025 04:30:00 +0000

Type Values Removed Values Added
Description The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:32:29.584Z

Reserved: 2025-06-27T12:07:46.189Z

Link: CVE-2025-6781

cve-icon Vulnrichment

Updated: 2025-07-18T14:54:35.560Z

cve-icon NVD

Status : Deferred

Published: 2025-07-18T05:15:31.950

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-6781

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T22:15:06Z

Weaknesses