CVE-2025-2168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2168", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-10T14:05:43.035Z", "datePublished": "2025-05-01T03:23:39.967Z", "dateUpdated": "2026-04-08T17:13:05.197Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:05.197Z"}, "affected": [{"vendor": "bdthemes", "product": "Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43"}, {"url": "https://plugins.trac.wordpress.org/changeset/3283438/ultimate-store-kit/trunk/admin/admin-notice.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3255125/ultimate-store-kit/trunk/admin/admin-notice.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-04-30T14:30:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-01T13:21:16.414556Z", "id": "CVE-2025-2168", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-01T13:21:23.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-01T13:21:16.414556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-01T13:21:19.914Z"}}], "cna": {"title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "bdthemes", "product": "Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-30T14:30:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43"}, {"url": "https://plugins.trac.wordpress.org/changeset/3283438/ultimate-store-kit/trunk/admin/admin-notice.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3255125/ultimate-store-kit/trunk/admin/admin-notice.php"}], "descriptions": [{"lang": "en", "value": "The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:05.197Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2168", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:13:05.197Z", "dateReserved": "2025-03-10T14:05:43.035Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-01T03:23:39.967Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor", "vendor": "bdthemes", "versions": [{"lessThanOrEqual": "2.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bdthemes:ultimate_store_kit:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "A8C6282F-D638-42B1-AF98-2717C8DE945E", "versionEndExcluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "Los complementos Ultimate Store Kit para Elementor, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table y Woocommerce Slider para WordPress son vulnerables a Cross-Site Request Forgery en todas las versiones hasta la 2.4.1 (incluida). Esto se debe a la falta o a una validaci\u00f3n de nonce incorrecta en la funci\u00f3n dismiss(). Esto permite a atacantes no autenticados establecer valores meta de usuario arbitrarios en `1`, lo que puede utilizarse para bloquear el acceso de un administrador a su sitio mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-2168", "lastModified": "2026-06-17T09:06:27.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-01T13:21:16.414556Z", "version": "2.0.3"}}]}, "published": "2025-05-01T04:16:53.127", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3255125/ultimate-store-kit/trunk/admin/admin-notice.php"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3283438/ultimate-store-kit/trunk/admin/admin-notice.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T04:11:51.528377+00:00", "value": {"mitigation_remediation": ["Update the Ultimate Store Kit plugin to version 2.4.2 or later, which includes proper nonce validation for the dismiss() function.", "If an immediate update is not possible, temporarily disable or uninstall the plugin until a patch is released to remove the attack surface.", "Monitor site administrators for unexpected changes to user meta values and verify that the dismiss() function does not allow arbitrary updates; investigate any unauthorized lockout events and reset affected accounts."], "summary": {"action": "Patch", "impact": "Unauthorized administrative lockout via CSRF"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the BDThemes Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor plugin version 2.4.1 or earlier are affected. The plugin is released under the free WordPress tier and can be identified by its name and vendor.", "description_and_impact": "The flaw is a cross\u2011site request forgery vulnerability caused by missing or incorrect nonce validation in the dismiss() function of the Ultimate Store Kit plugin. An attacker who can persuade a logged\u2011in administrator to visit a crafted link can cause the plugin to write arbitrary user\u2011meta values, typically setting them to \u201c1\u201d, which may lock the administrator account and prevent legitimate access to the site. While the flaw does not provide code execution or direct data theft, it enables a denial of service against a privileged account and can disrupt site administration.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1\u202f% suggests a very low likelihood of exploitation in the wild. The issue is not listed in CISA\u2019s KEV catalog. Exploitation requires an authenticated administrator to click a malicious link, so successful attacks depend on social engineering rather than automated scanning. The CSRF vector can be triggered from any external page, making the vulnerability network\u2011based but not locally privileged."}}}}, "created": "2026-04-22T04:15:07.539863+00:00", "updated": "2026-04-22T04:15:07.539875+00:00", "vendors": []}