CVE-2025-4199

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4199", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-01T13:18:25.138Z", "datePublished": "2025-05-03T01:43:07.311Z", "dateUpdated": "2026-04-08T17:31:57.680Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:57.680Z"}, "affected": [{"vendor": "withinboredom", "product": "Abundatrade Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.02", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php"}, {"url": "https://wordpress.org/plugins/abundatrade-plugin/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-05-02T11:36:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-05T14:40:38.465098Z", "id": "CVE-2025-4199", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T14:57:56.233Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-05T14:40:38.465098Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T14:40:39.705Z"}}], "cna": {"title": "Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "withinboredom", "product": "Abundatrade Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8.02"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-02T11:36:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php"}, {"url": "https://wordpress.org/plugins/abundatrade-plugin/"}], "descriptions": [{"lang": "en", "value": "The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:57.680Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4199", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:57.680Z", "dateReserved": "2025-05-01T13:18:25.138Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-03T01:43:07.311Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Abundatrade Plugin", "vendor": "withinboredom", "versions": [{"lessThanOrEqual": "1.8.02", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Abundatrade Plugin para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.8.02 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la p\u00e1gina \"abundatrade\". Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-4199", "lastModified": "2026-06-17T09:32:45.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4199", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-05T14:40:38.465098Z", "version": "2.0.3"}}]}, "published": "2025-05-03T03:15:29.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/abundatrade-plugin/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:59:04.777448+00:00", "value": {"mitigation_remediation": ["Update the Abundatrade Plugin to the latest version available from the WordPress plugin repository, which is expected to contain the nonce validation fix.", "If an upgrade is not immediately possible, disable or delete the plugin from the site entirely.", "Block external access to the 'abundatrade' admin endpoint by using a web application firewall or restricting the page to trusted IP ranges.", "Review all administrative plugins for proper nonce checks and consider installing a site\u2011wide request forgery prevention plugin."], "summary": {"action": "Apply Patch", "impact": "Stored XSS via CSRF in Abundatrade Plugin"}, "threat_synthesis": {"affected_systems": "The plugin is distributed by withinboredom and is available on the WordPress plugin repository. Versions up to and including 1.8.02 are affected. The vulnerability is specific to the Abundatrade Plugin within WordPress installations that have the plugin activated. No other WordPress core components are impacted.", "description_and_impact": "This vulnerability arises from a missing or incorrect nonce validation on the 'abundatrade' page of the Abundatrade WordPress plugin, allowing an unauthenticated attacker to forge a request and modify the plugin's settings. By injecting malicious scripts through the forgery, the attacker can store cross\u2011site scripting code that will execute in the context of an administrator who later visits the site. The weakness is classified as CWE\u2011352, which represents improper or missing validation of intended authorization. Because the redirected script runs with the privileges of the site admin, an attacker can hijack sessions, deface the site, or exfiltrate sensitive content.", "risk_and_exploitability": "The CVSS score of 6.1 denotes a moderate severity. EPSS < 1% indicates the likelihood of exploitation is very low at present, and the vulnerability has not been listed in the CISA KEV catalog. The attack requires a social engineering step; the attacker must supply a crafted link to a site administrator who then clicks it, triggering the CSRF request. Because the vulnerable action runs as an authenticated administrator, the impact of successful exploitation is high, underlining the importance of timely remediation."}}}}, "created": "2026-04-21T21:00:36.013621+00:00", "updated": "2026-04-21T21:00:36.013632+00:00", "vendors": []}