CVE-2025-10301

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10301", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-11T21:09:41.572Z", "datePublished": "2025-10-15T08:25:52.768Z", "dateUpdated": "2026-04-08T16:46:06.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:06.358Z"}, "affected": [{"vendor": "flenskiproject", "product": "FunKItools", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36231136-58ec-4a6d-8cfc-d3d69c31037d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funkitools/trunk/includes/controllers/options/page.php#L59"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-14T19:45:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T19:39:56.046512Z", "id": "CVE-2025-10301", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:40:33.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10301", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T19:39:56.046512Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:40:29.780Z"}}], "cna": {"title": "FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "flenskiproject", "product": "FunKItools", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T19:45:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36231136-58ec-4a6d-8cfc-d3d69c31037d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/funkitools/trunk/includes/controllers/options/page.php#L59"}], "descriptions": [{"lang": "en", "value": "The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:06.358Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10301", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:46:06.358Z", "dateReserved": "2025-09-11T21:09:41.572Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:25:52.768Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FunKItools", "vendor": "flenskiproject", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin FunKItools para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0.2, inclusive. Esto se debe a la falta o la incorrecci\u00f3n de la validaci\u00f3n de nonce en la funci\u00f3n saveFields(). Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-10301", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10301", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T19:39:56.046512Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:39.610", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/funkitools/trunk/includes/controllers/options/page.php#L59"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36231136-58ec-4a6d-8cfc-d3d69c31037d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:08:52.614531+00:00", "value": {"mitigation_remediation": ["Upgrade FunKItools to the latest version that includes CSRF protection for the settings update route.", "If an upgrade is not immediately possible, disable the saveFields() function or enforce role\u2011based access controls so that only privileged administrators can modify plugin settings.", " Employ a reputable security plugin that validates nonces on all configuration pages to add an extra layer of protection."], "summary": {"action": "Update Plugin", "impact": "Unauthorized Settings Modification"}, "threat_synthesis": {"affected_systems": "All FunKItools WordPress plugin versions up to and including 1.0.2, distributed by flenskiproject, are impacted. Sites running any of these versions must inspect their plugin settings for unintentional changes and apply mitigations.", "description_and_impact": "The FunKItools WordPress plugin suffers from a Cross\u2011Site Request Forgery flaw that allows an attacker who convinces an administrator to click a crafted link to alter the plugin\u2019s configuration. The weakness stems from missing or incorrect nonce validation in the saveFields() function, letting unauthenticated requests update settings. This does not provide code execution or data theft but can modify site behavior, potentially enabling further exploitation or disrupting functionality.", "risk_and_exploitability": "With a CVSS score of 4.3 this vulnerability is considered moderate. The EPSS score is below 1%, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Attackers need only social engineering to have a logged\u2011in administrator perform a forged request; no additional technical barriers are required."}}}}, "created": "2025-10-20T13:27:02.308068+00:00", "updated": "2026-04-22T14:15:20.401709+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}