CVE-2025-6838

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6838", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-27T18:38:38.615Z", "datePublished": "2025-07-11T08:22:23.583Z", "dateUpdated": "2026-04-08T17:24:11.458Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:11.458Z"}, "affected": [{"vendor": "apos37", "product": "Broken Link Notifier", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration."}], "title": "Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323864%40broken-link-notifier&new=3323864%40broken-link-notifier&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1236 Improper Neutralization of Formula Elements in a CSV File", "cweId": "CWE-1236", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "baseScore": 4.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-07-07T15:23:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-10T19:45:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-11T15:25:04.831070Z", "id": "CVE-2025-6838", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T15:25:30.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6838", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-11T15:25:04.831070Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T15:25:25.078Z"}}], "cna": {"title": "Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"}}], "affected": [{"vendor": "apos37", "product": "Broken Link Notifier", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-07T15:23:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-10T19:45:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323864%40broken-link-notifier&new=3323864%40broken-link-notifier&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1236", "description": "CWE-1236 Improper Neutralization of Formula Elements in a CSV File"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:11.458Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6838", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:11.458Z", "dateReserved": "2025-06-27T18:38:38.615Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-11T08:22:23.583Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Broken Link Notifier", "vendor": "apos37", "versions": [{"lessThanOrEqual": "1.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration."}, {"lang": "es", "value": "El complemento Broken Link Notifier para WordPress es vulnerable a la inyecci\u00f3n de CSV en todas las versiones hasta la 1.3.0 incluida, a trav\u00e9s de enlaces rotos que se exportan posteriormente. Esto permite a atacantes autenticados, con acceso de Colaborador o superior, incrustar informaci\u00f3n no confiable en archivos CSV exportados, lo que puede provocar la ejecuci\u00f3n de c\u00f3digo al descargar y abrir estos archivos en un sistema local con una configuraci\u00f3n vulnerable."}], "id": "CVE-2025-6838", "lastModified": "2026-06-17T10:02:39.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6838", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-11T15:25:04.831070Z", "version": "2.0.3"}}]}, "published": "2025-07-11T09:15:25.200", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323864%40broken-link-notifier&new=3323864%40broken-link-notifier&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1236"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:19:36.169034+00:00", "value": {"mitigation_remediation": ["Upgrade the Broken Link Notifier plugin to the latest version that addresses the CSV injection flaw.", "If an upgrade cannot be applied immediately, remove or restrict the CSV export function for users with Contributor-level or higher permissions to prevent injection opportunities.", "Continuously monitor WordPress installations for unauthorized or modified CSV files and verify that any exported data does not contain unexpected formulas."], "summary": {"action": "Update plugin", "impact": "CSV injection enabling local code execution when uploaded files are opened by authenticated users with Contributor or higher role"}, "threat_synthesis": {"affected_systems": "All releases of the Broken Link Notifier plugin for WordPress up to and including version 1.3.0 are affected. The plugin is released by vendor apos37 and is distributed through the WordPress plugin repository.", "description_and_impact": "The Broken Link Notifier plugin contains a CSV Injection flaw that allows authenticated users who have Contributor-level or higher privileges to embed malicious spreadsheet formulas into exported CSV files. When a user opens such a file in a spreadsheet application that evaluates formulas, the injected content can execute arbitrary code on the local system. The vulnerability is classified as CWE\u20111236.", "risk_and_exploitability": "The CVSS base score of 4.1 indicates a moderate severity that requires authentication. The EPSS score is less than 1%, implying a low likelihood of widespread exploitation, and the issue is not listed in the CISA KEV catalog. Attackers must first use the exporter to create the CSV, then persuade a user with a vulnerable spreadsheet application to open the file. Successful exploitation results in code execution on the local machine only when the file is processed."}}}}, "created": "2025-07-13T11:06:11.997758+00:00", "updated": "2026-04-20T20:30:16.068116+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}