CVE-2025-5930

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5930", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T14:46:26.544Z", "datePublished": "2025-06-13T01:47:48.918Z", "dateUpdated": "2026-04-08T17:14:50.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:50.177Z"}, "affected": [{"vendor": "digitalacornjp", "product": "WP2HTML", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac34e369-de9e-4b13-8858-0b4300aef5f8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3339090/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-06-12T13:08:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-13T14:03:04.518179Z", "id": "CVE-2025-5930", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-13T14:03:11.421Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5930", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-13T14:03:04.518179Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-13T14:03:08.626Z"}}], "cna": {"title": "WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "digitalacornjp", "product": "WP2HTML", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-12T13:08:43.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac34e369-de9e-4b13-8858-0b4300aef5f8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3339090/"}], "descriptions": [{"lang": "en", "value": "The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:50.177Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5930", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:50.177Z", "dateReserved": "2025-06-09T14:46:26.544Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-13T01:47:48.918Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP2HTML", "vendor": "digitalacornjp", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento WP2HTML para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.0.2 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n save(). Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n del complemento mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. "}], "id": "CVE-2025-5930", "lastModified": "2026-06-17T09:49:03.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5930", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-13T14:03:04.518179Z", "version": "2.0.3"}}]}, "published": "2025-06-13T03:15:52.910", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3339090/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac34e369-de9e-4b13-8858-0b4300aef5f8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:18:09.541370+00:00", "value": {"mitigation_remediation": ["Update the WP2HTML plugin to the latest version (1.0.3 or newer).", "Deploy a site\u2011wide CSRF protection strategy\u2014such as installing a security plugin that enforces per\u2011action nonce checks or configuring WordPress to reject requests without a valid nonce.", "Strengthen administrator account security by enabling two\u2011factor authentication and monitoring for anomalous configuration changes."], "summary": {"action": "Patch Update", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "Digital Acorn JP\u2019s WP2HTML plugin for WordPress, versions 1.0.2 and earlier. Users of any WordPress installation running these plugin versions are affected, regardless of other plugins or themes.", "description_and_impact": "The WP2HTML WordPress plugin contains a missing or incorrect nonce validation in its save() function, allowing an unauthenticated attacker to submit a forged request that updates the plugin\u2019s configuration settings. An attacker must entice a privileged site administrator to click a crafted link or visit a malicious page, after which the unverified settings change succeeds. The exploit does not grant code execution, but altering settings can lead to indirect compromises or unwanted behavior within the WordPress environment.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. The EPSS score is below 1\u202f%, suggesting a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers rely on social engineering to convince an administrator to perform a request, meaning the attack vector is user\u2011interaction\u2011based and typically does not automatically compromise the site."}}}}, "created": "2026-04-21T20:30:27.394690+00:00", "updated": "2026-04-21T20:30:27.394700+00:00", "vendors": []}