CVE-2025-0808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0808", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-28T15:09:43.326Z", "datePublished": "2025-02-12T03:21:38.857Z", "dateUpdated": "2026-04-08T17:00:12.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:12.074Z"}, "affected": [{"vendor": "propertyhive", "product": "Houzez Property Feed", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the \"deleteexport\" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd866ac-6094-4f76-9fba-69494381214c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3235031/houzez-property-feed/trunk/includes/class-houzez-property-feed-export.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dhabaleshwar Das"}], "timeline": [{"time": "2025-02-11T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-12T15:03:31.795598Z", "id": "CVE-2025-0808", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T15:03:49.701Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-12T15:03:31.795598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T15:03:39.404Z"}}], "cna": {"title": "Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Dhabaleshwar Das"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "propertyhive", "product": "Houzez Property Feed", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-11T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd866ac-6094-4f76-9fba-69494381214c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3235031/houzez-property-feed/trunk/includes/class-houzez-property-feed-export.php"}], "descriptions": [{"lang": "en", "value": "The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the \"deleteexport\" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:12.074Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0808", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:00:12.074Z", "dateReserved": "2025-01-28T15:09:43.326Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-12T03:21:38.857Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Houzez Property Feed", "vendor": "propertyhive", "versions": [{"lessThanOrEqual": "2.4.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp-property-hive:houzez_property_feed:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "79F87BD2-E357-41B4-A3BB-18A74235DFA5", "versionEndExcluding": "2.4.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the \"deleteexport\" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Houzez Property Feed para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.4.21 y incluida. Esto se debe a una validaci\u00f3n de nonce incorrecta o faltante en la acci\u00f3n \"deleteexport\". Esto hace posible que atacantes no autenticados eliminen las exportaciones del feed de propiedades a trav\u00e9s de una solicitud falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-0808", "lastModified": "2026-06-17T08:27:10.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0808", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-12T15:03:31.795598Z", "version": "2.0.3"}}]}, "published": "2025-02-12T04:15:09.950", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3235031/houzez-property-feed/trunk/includes/class-houzez-property-feed-export.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd866ac-6094-4f76-9fba-69494381214c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:42:15.690645+00:00", "value": {"mitigation_remediation": ["Update the Houzez Property Feed plugin to the latest version (2.4.22 or later) or any release that fixes the nonce validation for the deleteexport action.", "If updating immediately is not possible, remove unused export files from the server and restrict the export deletion functionality to users with explicit administrative roles by implementing server\u2011side access checks.", "Educate site administrators to avoid clicking untrusted links and to verify the authenticity of URLs before execution."], "summary": {"action": "Patch", "impact": "Unauthorized Deletion of Property Feed Exports"}, "threat_synthesis": {"affected_systems": "WordPress sites using the propertyhive Houzez Property Feed plugin version 2.4.21 or earlier are affected. Site administrators who have the ability to trigger the deleteexport action are the direct concern, as the vulnerability requires an authenticated administrator to execute the forged request.", "description_and_impact": "The Houzez Property Feed plugin for WordPress has a Cross\u2011Site Request Forgery vulnerability that allows an attacker to delete property feed exports. The flaw is caused by missing or incorrect nonce validation on the deleteexport action. When exploited, an attacker can cause the loss of exported data, impacting the integrity and availability of the property listings provided by the feed.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low probability of being actively exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick an administrator into visiting a crafted URL or clicking a malicious link, making the attack vector a human\u2011mediated Cross\u2011Site Request Forgery."}}}}, "created": "2026-04-28T03:45:20.282607+00:00", "updated": "2026-04-28T03:45:20.282619+00:00", "vendors": []}