CVE-2025-13520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13520", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-21T19:13:18.990Z", "datePublished": "2026-01-07T08:21:55.286Z", "dateUpdated": "2026-04-08T17:30:40.727Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:40.727Z"}, "affected": [{"vendor": "mtcaptcha", "product": "MTCaptcha WordPress Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1e568-7170-40d6-b522-2c89725e0501?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/trunk/mt-captcha.php#L410"}, {"url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/tags/2.7.2/mt-captcha.php#L410"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-06T19:35:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:46:54.258002Z", "id": "CVE-2025-13520", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:12:19.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:46:54.258002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:46:56.180Z"}}], "cna": {"title": "MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mtcaptcha", "product": "MTCaptcha WordPress Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.7.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T19:35:15.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1e568-7170-40d6-b522-2c89725e0501?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/trunk/mt-captcha.php#L410"}, {"url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/tags/2.7.2/mt-captcha.php#L410"}], "descriptions": [{"lang": "en", "value": "The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T08:21:55.286Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13520", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:12:19.395Z", "dateReserved": "2025-11-21T19:13:18.990Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T08:21:55.286Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MTCaptcha WordPress Plugin", "vendor": "mtcaptcha", "versions": [{"lessThanOrEqual": "2.7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin de WordPress MTCaptcha para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.7.2, inclusive. Esto se debe a la falta o la incorrecta validaci\u00f3n de nonce en la funcionalidad de actualizaci\u00f3n de ajustes. Esto hace posible que atacantes no autenticados actualicen los ajustes del plugin, incluyendo valores sensibles como la clave privada, a trav\u00e9s de una petici\u00f3n falsificada siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13520", "lastModified": "2026-06-17T08:34:16.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13520", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:46:54.258002Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:48.623", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/tags/2.7.2/mt-captcha.php#L410"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mtcaptcha/trunk/mt-captcha.php#L410"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1e568-7170-40d6-b522-2c89725e0501?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:33:24.056172+00:00", "value": {"mitigation_remediation": ["Upgrade the MTCaptcha plugin to the latest version (2.7.3 or later).", "If an upgrade is not immediately possible, remove or disable the MTCaptcha plugin entirely to eliminate the attack surface.", "Implement a site\u2011wide CSRF protection mechanism, such as a security plugin that enforces nonce validation on all admin POST requests, to defend against similar future vulnerabilities."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery that permits unauthorized plugin settings modification"}, "threat_synthesis": {"affected_systems": "Versions of the MTCaptcha WordPress Plugin up to and including 2.7.2 are affected. The vulnerability is reported for all deployments of this plugin that have not yet applied the latest fix. Only sites running a newer plugin version are immune.", "description_and_impact": "The MTCaptcha WordPress Plugin contains a Cross\u2011Site Request Forgery weakness that allows an attacker to modify the plugin\u2019s configuration, including sensitive values such as the private key. This flaw stems from omitted or incorrect nonce validation on the settings\u2011update routine and is categorized as CWE\u2011352. If exploited, an attacker could alter authentication credentials or other critical settings without needing administrator credentials. The impact is a potential compromise of the site\u2019s security configuration and loss of trust in the protected functionalities that rely on the plugin.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require a social\u2011engineering component, such as convincing a site administrator to click a crafted link that submits a forged request to the settings endpoint. No additional conditions beyond the normal administrator session are required for exploitation."}}}}, "created": "2026-01-08T09:49:34.149913+00:00", "updated": "2026-04-21T00:45:23.085973+00:00", "vendors": ["mtcaptcha", "mtcaptcha$PRODUCT$wordpress_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}