CVE-2025-5142

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5142", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-23T21:35:47.581Z", "datePublished": "2025-05-30T09:22:06.854Z", "dateUpdated": "2026-04-08T16:57:48.929Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:48.929Z"}, "affected": [{"vendor": "pluginsandsnippets", "product": "Simple Page Access Restriction", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.31", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for unauthenticated attackers to (1) enable or disable access protection on all post types or taxonomies, (2) force every new page/post to be public or private, regardless of meta-box settings, (3) cause a silent wipe of all plugin data when it\u2019s later removed, or (4) to conduct URL redirection attacks via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/657e2a4d-7e10-495d-8352-1adc0cb89e83?source=cve"}, {"url": "https://wordpress.org/plugins/simple-page-access-restriction/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-page-access-restriction/tags/1.0.31/includes/admin/settings/settings.php#L16"}, {"url": "https://plugins.trac.wordpress.org/changeset/3300680/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-05-29T20:43:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T12:51:41.846060Z", "id": "CVE-2025-5142", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T12:52:15.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T12:51:41.846060Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T12:52:07.562Z"}}], "cna": {"title": "Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "pluginsandsnippets", "product": "Simple Page Access Restriction", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.31"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-29T20:43:33.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/657e2a4d-7e10-495d-8352-1adc0cb89e83?source=cve"}, {"url": "https://wordpress.org/plugins/simple-page-access-restriction/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-page-access-restriction/tags/1.0.31/includes/admin/settings/settings.php#L16"}, {"url": "https://plugins.trac.wordpress.org/changeset/3300680/"}], "descriptions": [{"lang": "en", "value": "The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for unauthenticated attackers to (1) enable or disable access protection on all post types or taxonomies, (2) force every new page/post to be public or private, regardless of meta-box settings, (3) cause a silent wipe of all plugin data when it\u2019s later removed, or (4) to conduct URL redirection attacks via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-30T09:22:06.854Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5142", "state": "PUBLISHED", "dateUpdated": "2025-05-30T12:52:15.184Z", "dateReserved": "2025-05-23T21:35:47.581Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-30T09:22:06.854Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Simple Page Access Restriction", "vendor": "pluginsandsnippets", "versions": [{"lessThanOrEqual": "1.0.31", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluginsandsnippets:simple_page_access_restriction:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "05D18A9C-3394-4E84-9D26-428448F6B49F", "versionEndExcluding": "1.0.32", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for unauthenticated attackers to (1) enable or disable access protection on all post types or taxonomies, (2) force every new page/post to be public or private, regardless of meta-box settings, (3) cause a silent wipe of all plugin data when it\u2019s later removed, or (4) to conduct URL redirection attacks via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Simple Page Access Restriction para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.0.31 incluida. Esto se debe a la falta de validaci\u00f3n de nonce y comprobaciones de capacidad en el controlador de guardado de la configuraci\u00f3n del script settings.php. Esto permite a atacantes no autenticados (1) habilitar o deshabilitar la protecci\u00f3n de acceso en todos los tipos de entradas o taxonom\u00edas, (2) forzar que cada nueva p\u00e1gina/entrada sea p\u00fablica o privada, independientemente de la configuraci\u00f3n del metabox, (3) provocar un borrado silencioso de todos los datos del complemento al eliminarlo posteriormente, o (4) realizar ataques de redirecci\u00f3n de URL mediante una solicitud falsificada, siempre que puedan enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-5142", "lastModified": "2026-06-17T09:47:19.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5142", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-30T12:51:41.846060Z", "version": "2.0.3"}}]}, "published": "2025-05-30T10:15:25.640", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/simple-page-access-restriction/tags/1.0.31/includes/admin/settings/settings.php#L16"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3300680/"}, {"source": "security@wordfence.com", "tags": ["Product", "Release Notes"], "url": "https://wordpress.org/plugins/simple-page-access-restriction/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/657e2a4d-7e10-495d-8352-1adc0cb89e83?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:34:31.722051+00:00", "value": {"mitigation_remediation": ["Update the Simple Page Access Restriction plugin to the latest version (1.0.32 or newer) which adds the missing nonce validation and capability checks.", "If an immediate update is not possible, temporarily disable the plugin until a patch is applied or restrict access to the plugin settings page to trusted administrators through role\u2011based access control.", "Review the site for any anomalous setting changes or redirects and revert to safe configurations if necessary."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The affected product is the Simple Page Access Restriction plugin for WordPress, in all versions up to and including 1.0.31. Administrators running a WordPress installation with the plugin installed, particularly those with the plugin's settings interface, are at risk. No other WordPress core versions were listed as affected.", "description_and_impact": "The vulnerability arises from missing nonce validation and capability checks in the settings save handler, enabling unauthenticated attackers to alter protection settings for all post types, force public or private status on new content, delete all plugin data upon removal, or launch URL redirection attacks. These actions compromise the integrity of the site's content and can lead to unintended disclosure or malicious redirects, affecting all users who view the manipulated content. The weakness corresponds to CWE\u2011352, a classic CSRF flaw.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a moderate impact, and the very low EPSS score (<1%) suggests that exploitation is not widespread, but the risk remains due to the ability to change site\u2011wide settings and force content visibility. The lack of listing in CISA KEV means no known mass exploitation, yet it should still be addressed promptly. Attackers can exploit by directing an administrator to a crafted request to the plugin\u2019s settings endpoint, bypassing nonce checks."}}}}, "created": "2026-04-21T20:45:25.973974+00:00", "updated": "2026-04-21T20:45:25.973985+00:00", "vendors": []}