CVE-2025-13363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13363", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T16:48:31.220Z", "datePublished": "2025-12-12T03:20:47.659Z", "dateUpdated": "2026-04-08T16:58:26.023Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:26.023Z"}, "affected": [{"vendor": "imaqpress", "product": "IMAQ CORE", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the URL structure settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's URL structure settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/684de9c5-6f94-455d-b095-9f2df733ab95?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/imaq-core/trunk/libs/AcademixCorePermalink.php#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/imaq-core/tags/1.2.1/libs/AcademixCorePermalink.php#L58"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-11T15:06:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T20:59:08.167456Z", "id": "CVE-2025-13363", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:15:09.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:59:08.167456Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:59:46.449Z"}}], "cna": {"title": "IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "imaqpress", "product": "IMAQ CORE", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T15:06:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/684de9c5-6f94-455d-b095-9f2df733ab95?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/imaq-core/trunk/libs/AcademixCorePermalink.php#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/imaq-core/tags/1.2.1/libs/AcademixCorePermalink.php#L58"}], "descriptions": [{"lang": "en", "value": "The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the URL structure settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's URL structure settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:26.023Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13363", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:26.023Z", "dateReserved": "2025-11-18T16:48:31.220Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:47.659Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "IMAQ CORE", "vendor": "imaqpress", "versions": [{"lessThanOrEqual": "1.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the URL structure settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's URL structure settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin IMAQ Core para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.2.1, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funcionalidad de actualizaci\u00f3n de la configuraci\u00f3n de la estructura de URL. Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n de la estructura de URL del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13363", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13363", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T20:59:08.167456Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:41.490", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/imaq-core/tags/1.2.1/libs/AcademixCorePermalink.php#L58"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/imaq-core/trunk/libs/AcademixCorePermalink.php#L58"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/684de9c5-6f94-455d-b095-9f2df733ab95?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:29:25.627506+00:00", "value": {"mitigation_remediation": ["Upgrade IMAQ Core to a version newer than 1.2.1 that includes proper nonce validation for URL structure updates.", "If an upgrade is not immediately possible, restrict access to the URL structure settings page by applying role\u2011based permissions or disabling the settings through WordPress configuration.", "Educate administrators against clicking untrusted links and monitor for anomalous admin activity to detect potential CSRF attempts."], "summary": {"action": "Patch", "impact": "Unauthorized modification of WordPress plugin settings via Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "WordPress sites running IMAQ Core 1.2.1 or earlier are affected. The plugin is issued by imaqpress under the product name\u00a0IMAQ CORE. No specific version numbers beyond 1.2.1 are mentioned as vulnerable.", "description_and_impact": "The IMAQ Core plugin contains a Cross\u2011Site Request Forgery vulnerability that allows an unauthenticated attacker to change the plugin\u2019s URL structure settings. The flaw arises from missing nonce verification during the update process, enabling a forged request to execute when an administrator clicks a malicious link. This weakness permits the attacker to alter how the plugin rewrites URLs, potentially disrupting site navigation or redirecting traffic.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low\u2011medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker can exploit this weakness by directing a site administrator to visit a crafted link that submits a CSRF request to update the URL structure settings. Because the attacker need not authenticate, the impact is limited to the scope of the plugin\u2019s configuration, but it could disturb site functionality or enable further damage if other plugin settings are affected."}}}}, "created": "2025-12-12T08:47:59.975075+00:00", "updated": "2026-04-21T17:30:37.704170+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}