CVE-2025-10309

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10309", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-11T22:49:58.682Z", "datePublished": "2025-10-03T11:17:15.998Z", "dateUpdated": "2026-04-08T17:06:05.902Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:05.902Z"}, "affected": [{"vendor": "bsmye", "product": "PayPal Forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "PayPal Forms <= 1.0.3 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc25fe1-82f0-493b-a9d3-1a4892e35613?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-forms/trunk/paypal-forms.php#L533"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-02T22:12:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:12:35.587551Z", "id": "CVE-2025-10309", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:12:45.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T18:12:35.587551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:12:41.424Z"}}], "cna": {"title": "PayPal Forms <= 1.0.3 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "bsmye", "product": "PayPal Forms", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:12:54.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc25fe1-82f0-493b-a9d3-1a4892e35613?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paypal-forms/trunk/paypal-forms.php#L533"}], "descriptions": [{"lang": "en", "value": "The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-03T11:17:15.998Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10309", "state": "PUBLISHED", "dateUpdated": "2025-10-03T18:12:45.691Z", "dateReserved": "2025-09-11T22:49:58.682Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:15.998Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PayPal Forms", "vendor": "bsmye", "versions": [{"lessThanOrEqual": "1.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin PayPal Forms para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta e incluyendo la 1.0.3. Esto se debe a la falta de validaci\u00f3n de nonce en las funciones de creaci\u00f3n y gesti\u00f3n de formularios. Esto hace posible que atacantes no autenticados creen nuevos formularios de PayPal y modifiquen la configuraci\u00f3n de pago de PayPal a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-10309", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10309", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:12:35.587551Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:42.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/paypal-forms/trunk/paypal-forms.php#L533"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc25fe1-82f0-493b-a9d3-1a4892e35613?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:12:36.552548+00:00", "value": {"mitigation_remediation": ["Upgrade the PayPal Forms plugin to a patch release that includes the nonce validation fix", "If an upgrade cannot be performed immediately, limit administrative access and ensure that any form\u2011creation or payment\u2011setting URLs are protected by a strict anti\u2011CSRF mechanism such as same\u2011site cookies or additional authentication guards", "Deploy a security plugin or web\u2011application firewall rule that blocks or requires confirmation for unauthenticated state\u2011changing requests to the PayPal Forms endpoints"], "summary": {"action": "Apply Patch", "impact": "Unauthorized creation and alteration of PayPal payment forms"}, "threat_synthesis": {"affected_systems": "Platform: WordPress plugin named PayPal Forms from vendor bsmye. All releases up to and including version 1.0.3 are affected. The vulnerability is present in the form creation and management features accessed by site administrators.", "description_and_impact": "The PayPal Forms WordPress plugin allows unauthenticated attackers to construct new PayPal payment forms and modify existing payment settings because the plugin fails to validate nonces on form creation and management operations. This flaw enables an attacker to alter how payments are processed on a site, potentially redirecting funds, collecting sensitive information, or disabling legitimate transaction flows. The core weakness is a missing CSRF nonce, which is a documented cross\u2011site request forgery vulnerability (CWE\u2011352).", "risk_and_exploitability": "The overall CVSS score is 4.3, indicating a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. The attack requires the attacker to lure an administrator into submitting a crafted request, for example by clicking a malicious link. Once the request is processed, the attacker can create or alter PayPal payment forms without authentication. The expected impact is limited to compromised transaction configuration rather than full system compromise, but it can lead to financial loss or exposure of payment data if configuration changes allow illicit funds to be routed elsewhere. The risk is moderate, with exploitation likely constrained to environments where administrators do not exercise stringent click\u2011through vetting and where the plugin is installed in its vulnerable state."}}}}, "created": "2025-10-06T14:42:56.928751+00:00", "updated": "2026-04-22T14:15:20.421678+00:00", "vendors": ["bsmye", "bsmye$PRODUCT$paypal_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}