CVE-2025-13366

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13366", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T17:14:15.435Z", "datePublished": "2025-12-12T03:21:01.742Z", "dateUpdated": "2026-04-08T17:31:04.169Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:04.169Z"}, "affected": [{"vendor": "frapesce", "product": "Rabbit Hole", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the plugin's reset functionality. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability is exacerbated by the fact that the reset operation is performed via a GET request, making exploitation trivial via image tags or hyperlinks."}], "title": "Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eab5de7e-ddab-4c6f-af87-acce7b5ff15b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/trunk/functions/admin.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/tags/1.1/functions/admin.php#L7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-12-11T15:09:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T20:38:35.134975Z", "id": "CVE-2025-13366", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:38:41.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T20:38:35.134975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:38:38.398Z"}}], "cna": {"title": "Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "frapesce", "product": "Rabbit Hole", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T15:09:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eab5de7e-ddab-4c6f-af87-acce7b5ff15b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/trunk/functions/admin.php#L7"}, {"url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/tags/1.1/functions/admin.php#L7"}], "descriptions": [{"lang": "en", "value": "The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the plugin's reset functionality. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability is exacerbated by the fact that the reset operation is performed via a GET request, making exploitation trivial via image tags or hyperlinks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:04.169Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13366", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:04.169Z", "dateReserved": "2025-11-18T17:14:15.435Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:21:01.742Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Rabbit Hole", "vendor": "frapesce", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the plugin's reset functionality. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability is exacerbated by the fact that the reset operation is performed via a GET request, making exploitation trivial via image tags or hyperlinks."}, {"lang": "es", "value": "El plugin Rabbit Hole para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta e incluyendo la 1.1. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funcionalidad de restablecimiento del plugin. Esto hace posible que atacantes no autenticados restablezcan la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. La vulnerabilidad se ve exacerbada por el hecho de que la operaci\u00f3n de restablecimiento se realiza a trav\u00e9s de una petici\u00f3n GET, haciendo que la explotaci\u00f3n sea trivial a trav\u00e9s de etiquetas de imagen o hiperv\u00ednculos."}], "id": "CVE-2025-13366", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13366", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T20:38:35.134975Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:41.663", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/tags/1.1/functions/admin.php#L7"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/rabbit-hole/trunk/functions/admin.php#L7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eab5de7e-ddab-4c6f-af87-acce7b5ff15b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:51:37.592278+00:00", "value": {"mitigation_remediation": ["Upgrade Rabbit Hole to a version that includes the CSRF fix or entire plugin update", "Restrict the reset endpoint to POST requests and ensure it verifies a valid nonce before executing", "Deploy a WordPress security plugin such as Wordfence to monitor and block suspicious request patterns"], "summary": {"action": "Apply Patch", "impact": "Cross-Site Request Forgery allowing an unauthenticated attacker to reset the Rabbit Hole plugin settings"}, "threat_synthesis": {"affected_systems": "All installations of Rabbit Hole for WordPress with version 1.1 or earlier, distributed by frapesce. The vulnerability applies to any WordPress site that has this plugin active and an administrator accounts with resetting privileges.", "description_and_impact": "The Rabbit Hole WordPress plugin suffers from a Cross\u2011Site Request Forgery flaw caused by missing or incorrect nonce validation on its reset function. An attacker can craft a simple GET request, such as an image tag or hyperlink, that forces a logged\u2011in site administrator to reset the plugin\u2019s configuration. The resulting action may compromise the site\u2019s security posture or operation by restoring default settings, disabling monitoring features, or exposing sensitive data changes.", "risk_and_exploitability": "With a CVSS score of 4.3 the flaw is considered low\u2011to\u2011moderate severity, but its exploitation is trivial because the malicious URL can be embedded in an image or link. The EPSS score is under 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web (network) and requires an attacker to persuade a site administrator to click a crafted link. Once triggered, the reset is performed via a GET request, making the exploit straightforward but limited to the administrator\u2019s session."}}}}, "created": "2025-12-12T08:48:01.191026+00:00", "updated": "2026-04-21T01:00:12.956147+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}