CVE-2025-13749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13749", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T16:42:23.521Z", "datePublished": "2026-01-09T05:25:20.788Z", "dateUpdated": "2026-04-08T16:53:29.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:29.118Z"}, "affected": [{"vendor": "creativemotion", "product": "Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.0. This is due to missing nonce validation on the \"wbcr_upm_change_flag\" function. This makes it possible for unauthenticated attackers to disable plugin/theme update notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55750dcf-c6ec-4be6-967f-60bf940fa30e?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-13749/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421009/clearfy"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-11-18T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-26T16:59:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T17:24:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T18:25:47.919119Z", "id": "CVE-2025-13749", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:25:55.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T18:25:47.919119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:25:51.232Z"}}], "cna": {"title": "Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "creativemotion", "product": "Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-18T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-26T16:59:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T17:24:32.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55750dcf-c6ec-4be6-967f-60bf940fa30e?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-13749/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421009/clearfy"}], "descriptions": [{"lang": "en", "value": "The Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.0. This is due to missing nonce validation on the \"wbcr_upm_change_flag\" function. This makes it possible for unauthenticated attackers to disable plugin/theme update notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:29.118Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13749", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:53:29.118Z", "dateReserved": "2025-11-26T16:42:23.521Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T05:25:20.788Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer", "vendor": "creativemotion", "versions": [{"lessThanOrEqual": "2.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.0. This is due to missing nonce validation on the \"wbcr_upm_change_flag\" function. This makes it possible for unauthenticated attackers to disable plugin/theme update notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin de optimizaci\u00f3n para WordPress Clearfy Cache \u2013 Minify HTML, CSS y JS, Defer es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.4.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n 'wbcr_upm_change_flag'. Esto permite a atacantes no autenticados deshabilitar las notificaciones de actualizaci\u00f3n de plugins/temas a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13749", "lastModified": "2026-06-17T08:34:41.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13749", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T18:25:47.919119Z", "version": "2.0.3"}}]}, "published": "2026-01-09T06:16:00.917", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421009/clearfy"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-13749/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55750dcf-c6ec-4be6-967f-60bf940fa30e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:02:02.455391+00:00", "value": {"mitigation_remediation": ["Upgrade Clearfy to version 2.4.1 or later to obtain the CSRF fix.", "Enforce two\u2011factor authentication for all administrator accounts and restrict administrative access to trusted IP addresses until the plugin is updated.", "Implement a web application firewall rule or .htaccess directive to block unauthenticated requests to the wbcr_upm_change_flag endpoint, thereby preventing CSRF until a patch is applied."], "summary": {"action": "Patch Plugin", "impact": "Update Notification Tampering via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress sites utilizing Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer from CreativeMotion; all releases up to and including version 2.4.0 are vulnerable. No specific sub\u2011versions are listed beyond this threshold.", "description_and_impact": "The Clearfy plugin suffers from a Cross\u2011Site Request Forgery flaw caused by missing nonce validation in the wbcr_upm_change_flag function. An attacker can forge a request that, if an administrator clicks a malicious link, will disable plugin or theme update notifications. This weakens security monitoring and can allow critical updates to be missed. The vulnerability is categorized as CWE-352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator to unknowingly click a forged link, thus the attack vector is CSRF with user interaction. The impact is confined to the ability to silence update notifications, rather than remote code execution or full control of the site."}}}}, "created": "2026-01-09T13:24:06.235599+00:00", "updated": "2026-04-22T00:15:03.761476+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}