CVE-2025-6059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6059", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-13T13:08:58.727Z", "datePublished": "2025-06-14T01:43:25.206Z", "dateUpdated": "2026-04-08T17:33:42.480Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:42.480Z"}, "affected": [{"vendor": "seraphinitesoft", "product": "Seraphinite Accelerator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.27.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2259"}, {"url": "https://plugins.trac.wordpress.org/changeset/3284098/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-04-29T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-16T16:46:07.635269Z", "id": "CVE-2025-6059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T18:40:14.761Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-16T16:46:07.635269Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T16:47:20.867Z"}}], "cna": {"title": "Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "seraphinitesoft", "product": "Seraphinite Accelerator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.27.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-29T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2259"}, {"url": "https://plugins.trac.wordpress.org/changeset/3284098/"}], "descriptions": [{"lang": "en", "value": "The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:42.480Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6059", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:42.480Z", "dateReserved": "2025-06-13T13:08:58.727Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-14T01:43:25.206Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Seraphinite Accelerator", "vendor": "seraphinitesoft", "versions": [{"lessThanOrEqual": "2.27.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Seraphinite Accelerator para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.27.21 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n 'OnAdminApi_CacheOpBegin'. Esto permite a atacantes no autenticados realizar diversas acciones administrativas, como borrar la cach\u00e9, mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6059", "lastModified": "2026-06-17T10:01:04.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-16T16:46:07.635269Z", "version": "2.0.3"}}]}, "published": "2025-06-14T03:15:22.283", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2259"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3284098/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:32:02.599122+00:00", "value": {"mitigation_remediation": ["Upgrade Seraphinite Accelerator to version 2.27.22 or later, which includes proper nonce validation for the affected function.", "If immediate upgrade is not possible, remove or disable the OnAdminApi_CacheOpBegin endpoint until a patch can be applied, or restrict access to that action to users with the Administrator role.", "Employ a web application firewall or security plugin that blocks CSRF attempts by validating nonces on administrative endpoints."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Request Forgery allowing unauthenticated users to trigger administrative actions such as cache deletion."}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin Seraphinite Accelerator up to and including version 2.27.21, provided by Seraphinite Software. No other versions are mentioned.", "description_and_impact": "The vulnerability is a missing or incorrect nonce check in the OnAdminApi_CacheOpBegin function, enabling a CSRF attack that lets unauthenticated users cause a logged\u2011in administrator to perform privileged actions like clearing the cache. This can disrupt site performance or logging without granting direct access to content.", "risk_and_exploitability": "CVSS score 4.3 indicates low severity. EPSS <1% shows a very low probability of exploitation. The flaw is not listed in CISA KEV, suggesting no known widespread exploitation yet. The attack requires a victim administrator to click a crafted link after the attacker lures them; thus it relies on social engineering, and no remote code execution or direct authentication is needed."}}}}, "created": "2026-04-20T22:45:20.537951+00:00", "updated": "2026-04-20T22:45:20.537962+00:00", "vendors": []}