CVE-2025-13924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13924", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-02T20:51:17.716Z", "datePublished": "2025-12-09T17:23:32.069Z", "dateUpdated": "2026-04-08T17:33:59.070Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:59.070Z"}, "affected": [{"vendor": "maartenbelmans", "product": "Advanced Product Fields (Product Addons) for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8906333-7024-40d3-91cd-2ecbbf20314f?source=cve"}, {"url": "https://github.com/Baodaica/advanced-product-fields-for-woocommerce/blob/main/class-admin-controller.php#L130-L133"}, {"url": "https://plugins.trac.wordpress.org/changeset/3411740/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen C"}], "timeline": [{"time": "2025-12-04T18:30:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-08T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T20:19:28.522658Z", "id": "CVE-2025-13924", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T20:42:36.512Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T20:19:28.522658Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T20:19:31.799Z"}}], "cna": {"title": "Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen C"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "maartenbelmans", "product": "Advanced Product Fields (Product Addons) for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.17"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T18:30:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-08T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8906333-7024-40d3-91cd-2ecbbf20314f?source=cve"}, {"url": "https://github.com/Baodaica/advanced-product-fields-for-woocommerce/blob/main/class-admin-controller.php#L130-L133"}, {"url": "https://plugins.trac.wordpress.org/changeset/3411740/"}], "descriptions": [{"lang": "en", "value": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:59.070Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13924", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:59.070Z", "dateReserved": "2025-12-02T20:51:17.716Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-09T17:23:32.069Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advanced Product Fields (Product Addons) for WooCommerce", "vendor": "maartenbelmans", "versions": [{"lessThanOrEqual": "1.6.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Advanced Product Fields (Product Addons) para WooCommerce para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.6.17, inclusive. Esto se debe a la validaci\u00f3n nonce faltante o incorrecta en la funci\u00f3n 'maybe_duplicate'. Esto hace posible que atacantes no autenticados dupliquen y publiquen grupos de campos de producto, incluyendo grupos de campos en borrador y pendientes, a trav\u00e9s de una petici\u00f3n falsificada siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13924", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13924", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T20:19:28.522658Z", "version": "2.0.3"}}]}, "published": "2025-12-09T18:15:49.037", "references": [{"source": "security@wordfence.com", "url": "https://github.com/Baodaica/advanced-product-fields-for-woocommerce/blob/main/class-admin-controller.php#L130-L133"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3411740/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8906333-7024-40d3-91cd-2ecbbf20314f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:58:34.913790+00:00", "value": {"mitigation_remediation": ["Upgrade Advanced Product Fields to version 1.6.18 or later.", "Disable or remove the plugin if it is no longer required for site functionality.", "Apply stricter role\u2011based access control and enforce multi\u2011factor authentication for administrator accounts.", "Configure analytics or logging to alert on unauthorized duplication attempts."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery enabling unauthorized duplication and publication of product field groups"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Advanced Product Fields (Product Addons) for WooCommerce plugin version 1.6.17 or earlier, released by maartenbelmans. Only those specific plugin versions are affected; recent releases beyond 1.6.17 have confirmed mitigation.", "description_and_impact": "The Advanced Product Fields (Product Addons) for WooCommerce plugin suffers from a missing or incorrect nonce check in the \u2018maybe_duplicate\u2019 function. This flaw allows an unauthenticated attacker to forge a request that duplicates existing product field groups and publishes them, including groups that were in draft or pending state. The impact is confined to the manipulation of product metadata, potentially altering the way product information is displayed to customers, but does not grant code execution or full access to the system.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate risk; the EPSS score of <\u20091% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real\u2011world usage. The attack path requires an administrator to be tricked into clicking a forged link, so while the vector exists, operational security practices such as monitoring administrator links and enforcing strong authentication reduce the practical threat."}}}}, "created": "2025-12-10T17:49:23.343556+00:00", "updated": "2026-04-21T01:00:12.985315+00:00", "vendors": ["maartenbelmans", "maartenbelmans$PRODUCT$advanced_product_fields_product_addons_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}