CVE-2025-12413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12413", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T15:38:24.764Z", "datePublished": "2025-11-04T04:27:14.981Z", "dateUpdated": "2026-04-08T16:42:56.439Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:56.439Z"}, "affected": [{"vendor": "socialmedialtd", "product": "WPCF7 Stop words", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27857a17-8cf0-40b3-894f-8dd7cf5108dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcf7-stop-words/tags/1.1.3/social-media-wpcf7-stop-words.php#L45"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-11-03T15:34:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T20:59:52.566316Z", "id": "CVE-2025-12413", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T21:00:10.133Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:59:52.566316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T21:00:00.898Z"}}], "cna": {"title": "Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "socialmedialtd", "product": "WPCF7 Stop words", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:34:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27857a17-8cf0-40b3-894f-8dd7cf5108dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcf7-stop-words/tags/1.1.3/social-media-wpcf7-stop-words.php#L45"}], "descriptions": [{"lang": "en", "value": "The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:56.439Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12413", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:56.439Z", "dateReserved": "2025-10-28T15:38:24.764Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:14.981Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPCF7 Stop words", "vendor": "socialmedialtd", "versions": [{"lessThanOrEqual": "1.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Social Media WPCF7 Stop Words para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.1.3, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n smWpCfSwOptions(). Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin e inyecten scripts web maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12413", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12413", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T20:59:52.566316Z", "version": "2.0.3"}}]}, "published": "2025-11-04T05:16:13.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpcf7-stop-words/tags/1.1.3/social-media-wpcf7-stop-words.php#L45"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27857a17-8cf0-40b3-894f-8dd7cf5108dd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:44:30.373920+00:00", "value": {"mitigation_remediation": ["Update the Social Media WPCF7 Stop Words plugin to version 1.1.4 or newer, which includes proper nonce validation. ", "If an immediate update is not possible, disable or uninstall the plugin\u2019s settings page until a patch is applied, ensuring that only trusted administrators can access configuration in the future. ", "Implement site\u2011wide Web Application Firewall rules to block POST requests lacking valid nonces for the plugin\u2019s settings endpoint, and educate administrators to recognize phishing attempts that may trigger unauthorized requests."], "summary": {"action": "Patch Immediately", "impact": "Cross\u2011Site Request Forgery enabling unauthorized updates of plugin settings and script injection"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Social Media WPCF7 Stop Words plugin, version 1.1.3 or earlier. The vulnerability applies to any installation that has not upgraded beyond 1.1.3, affecting user accounts with administrator privileges who have access to the plugin\u2019s settings page.", "description_and_impact": "The Social Media WPCF7 Stop Words plugin suffers from missing or incorrect nonce validation in its smWpCfSwOptions() function. An attacker who can trick a site administrator into submitting a request can change the plugin's settings and inject malicious web scripts. The impact is that the attacker gains execution capability within the website\u2019s context without requiring any authentication beyond a forged request. CWE\u2011352\"}", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to lure an administrator into performing a forged action\u2014most commonly a phishing link that triggers the plugin settings update without correct nonce verification. No additional prerequisites are noted beyond the ability to trick an admin user into clicking a malicious URL."}}}}, "created": "2025-11-04T16:33:32.757144+00:00", "updated": "2026-04-22T16:45:21.465653+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}