CVE-2025-7839

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7839", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-18T19:35:43.363Z", "datePublished": "2025-08-23T04:25:47.781Z", "dateUpdated": "2026-04-08T17:06:40.362Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:40.362Z"}, "affected": [{"vendor": "pokornydavid", "product": "Restore Permanently delete Post or Page Data", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restore-permanently-delete-post-or-page-data/trunk/delete-store-file.php#L305"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-08-22T15:52:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-25T17:10:01.506319Z", "id": "CVE-2025-7839", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-25T17:10:19.829Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7839", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-25T17:10:01.506319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-25T17:10:09.680Z"}}], "cna": {"title": "Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "pokornydavid", "product": "Restore Permanently delete Post or Page Data", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-22T15:52:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restore-permanently-delete-post-or-page-data/trunk/delete-store-file.php#L305"}], "descriptions": [{"lang": "en", "value": "The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:40.362Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7839", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:40.362Z", "dateReserved": "2025-07-18T19:35:43.363Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-23T04:25:47.781Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Restore Permanently delete Post or Page Data", "vendor": "pokornydavid", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Restore Permanently delete Post or Page Data para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.0 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n rp_dpo_dpa_ajax_dp_delete_data(). Esto permite que atacantes no autenticados eliminen datos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-7839", "lastModified": "2026-06-17T10:05:46.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7839", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-25T17:10:01.506319Z", "version": "2.0.3"}}]}, "published": "2025-08-23T05:15:32.923", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restore-permanently-delete-post-or-page-data/trunk/delete-store-file.php#L305"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:23:11.485162+00:00", "value": {"mitigation_remediation": ["Upgrade the Restore Permanently delete Post or Page Data plugin to the latest version that implements proper nonce validation.", "If an upgrade is unavailable, uninstall the plugin to eliminate the exposed endpoint.", "As an interim measure, restrict the AJAX delete endpoint to trusted users or add a custom CSRF check in the theme or a security plugin."], "summary": {"action": "Patch Immediately", "impact": "Unauthenticated data deletion via CSRF"}, "threat_synthesis": {"affected_systems": "The affected product is the pokornydavid Restore Permanently delete Post or Page Data WordPress plugin, versions 1.0 and earlier. Any WordPress site that has this plugin installed and has not upgraded beyond the vulnerable 1.0 release is impacted.", "description_and_impact": "The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery because the rp_dpo_dpa_ajax_dp_delete_data() function lacks proper nonce validation. This flaw allows an unauthenticated attacker, if they can persuade a site administrator to click a crafted link or URL, to delete posts or pages stored by the plugin. The vulnerability is limited to plugin functionality but results in irreversible data loss for the affected content.", "risk_and_exploitability": "The CVSS score of 4.3 reflects a low\u2011severity flaw, and the EPSS score of less than 1\u00a0% indicates that active exploitation is currently unlikely. The vulnerability is not listed in CISA\u2019s KEV catalog, and no public exploits have been documented. Nonetheless, because the attack path involves a simple forged request that can be triggered through a malicious link, the risk is low but not negligible. Site administrators should treat this as a low\u2011priority issue but still address it promptly to prevent potential data loss."}}}}, "created": "2025-08-23T11:53:08.366886+00:00", "updated": "2026-04-21T03:30:26.334739+00:00", "vendors": ["pokornydavid", "pokornydavid$PRODUCT$restore_delete_post_or_page_data_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}