CVE-2025-5937

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5937", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T15:40:57.508Z", "datePublished": "2025-06-28T07:25:06.195Z", "dateUpdated": "2026-04-08T17:26:42.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:42.452Z"}, "affected": [{"vendor": "videowhisper", "product": "MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d80417bc-2bb2-4826-be03-796a7cd2825f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paid-membership/trunk/inc/options.php#L1364"}, {"url": "https://plugins.trac.wordpress.org/changeset/3318389/#file0"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-06-26T15:41:50.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-06-27T19:13:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-30T18:26:57.851933Z", "id": "CVE-2025-5937", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-30T18:33:07.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5937", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-30T18:26:57.851933Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-30T18:33:02.436Z"}}], "cna": {"title": "MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "videowhisper", "product": "MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-26T15:41:50.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-06-27T19:13:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d80417bc-2bb2-4826-be03-796a7cd2825f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/paid-membership/trunk/inc/options.php#L1364"}, {"url": "https://plugins.trac.wordpress.org/changeset/3318389/#file0"}], "descriptions": [{"lang": "en", "value": "The MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:42.452Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5937", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:42.452Z", "dateReserved": "2025-06-09T15:40:57.508Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-28T07:25:06.195Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet", "vendor": "videowhisper", "versions": [{"lessThanOrEqual": "3.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:videowhisper:micropayments:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "D1C387DC-62C3-496B-B891-B6A65A3CFD45", "versionEndExcluding": "3.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet para WordPress es vulnerable a Cross Site Request Forgery en todas las versiones hasta la 3.2.0 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n adminOptions(). Esto permite que atacantes no autenticados restablezcan la configuraci\u00f3n del complemento mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-5937", "lastModified": "2026-06-17T09:49:04.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5937", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-30T18:26:57.851933Z", "version": "2.0.3"}}]}, "published": "2025-06-28T08:15:25.143", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/paid-membership/trunk/inc/options.php#L1364"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3318389/#file0"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d80417bc-2bb2-4826-be03-796a7cd2825f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:58:20.426002+00:00", "value": {"mitigation_remediation": ["Upgrade the MicroPayments \u2013 Fans Paysite plugin to the latest released version, which includes proper nonce validation.", "If an immediate upgrade is not feasible, disable access to the adminOptions endpoint (e.g., via .htaccess or a firewall rule) to prevent accidental resets.", "Deploy a Web Application Firewall or security plugin that detects and blocks CSRF requests targeting the plugin\u2019s settings URLs.", "Audit the site\u2019s current configuration and confirm no residual settings have been left exposed after the reset.", "Educate administrators to avoid clicking unknown links and to verify URLs before clicking."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Request Forgery allowing unauthenticated users to reset the plugin\u2019s configuration"}, "threat_synthesis": {"affected_systems": "WordPress installations running the MicroPayments \u2013 Fans Paysite plugin from videowhisper, from version 3.2.0 and earlier, are affected. Any site deploying these plugin versions is at risk until the configuration is updated.", "description_and_impact": "The MicroPayments \u2013 Fans Paysite plugin for WordPress suffers from a CSRF flaw caused by missing or improper nonce validation within the adminOptions() routine. This weakness exposes the plugin\u2019s settings to unauthenticated reset by any attacker that can compound a link or button click from a logged\u2011in administrator. The resulting exposure can alter subscription handling, financial assets, and wallet configurations, potentially disrupting service availability and compromising sensitive content. The flaw maps to CWE\u2011352, the common class of cross\u2011site request forgery vulnerabilities.", "risk_and_exploitability": "With a CVSS score of 4.3 the flaw presents moderate severity. The EPSS score of less than 1% indicates a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been commonly leveraged. Attackers can exploit this by luring an administrator into clicking a malicious link that sends a forged request containing the required administrative session cookie, thereby resetting the plugin settings. No specialized resources or elevated privileges are required beyond the targeted administrator\u2019s credentials."}}}}, "created": "2026-04-21T20:00:25.903492+00:00", "updated": "2026-04-21T20:00:25.903504+00:00", "vendors": []}