CVE-2025-8592

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8592", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-05T12:47:26.401Z", "datePublished": "2025-08-21T05:28:13.480Z", "dateUpdated": "2026-04-08T16:41:20.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:20.192Z"}, "affected": [{"vendor": "wpzoom", "product": "Inspiro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on the inspiro_install_plugin() function. This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20f461d1-aeb2-4913-804c-6a081e48765a?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/inspiro/2.1.1/inc/admin/pluginInstaller/class-inspiro-plugin-installer.php#L67"}, {"url": "https://research.cleantalk.org/cve-2025-8592/"}, {"url": "https://themes.trac.wordpress.org/ticket/228813"}, {"url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=284043%40inspiro%2F2.1.3&old=282419%40inspiro%2F2.1.2"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-08-14T17:15:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-20T16:43:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-21T15:45:37.598882Z", "id": "CVE-2025-8592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T15:45:46.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-21T15:45:37.598882Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T15:45:42.664Z"}}], "cna": {"title": "Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}}], "affected": [{"vendor": "wpzoom", "product": "Inspiro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-14T17:15:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-20T16:43:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20f461d1-aeb2-4913-804c-6a081e48765a?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/inspiro/2.1.1/inc/admin/pluginInstaller/class-inspiro-plugin-installer.php#L67"}, {"url": "https://research.cleantalk.org/cve-2025-8592/"}, {"url": "https://themes.trac.wordpress.org/ticket/228813"}, {"url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=284043%40inspiro%2F2.1.3&old=282419%40inspiro%2F2.1.2"}], "descriptions": [{"lang": "en", "value": "The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on the inspiro_install_plugin() function. This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:20.192Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8592", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:20.192Z", "dateReserved": "2025-08-05T12:47:26.401Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-21T05:28:13.480Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Inspiro", "vendor": "wpzoom", "versions": [{"lessThanOrEqual": "2.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on the inspiro_install_plugin() function. This makes it possible for unauthenticated attackers to install plugins from the repository via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El tema Inspiro para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.1.2 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n inspiro_install_plugin(). Esto permite que atacantes no autenticados instalen complementos desde el repositorio mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-8592", "lastModified": "2026-06-17T10:07:17.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8592", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-21T15:45:37.598882Z", "version": "2.0.3"}}]}, "published": "2025-08-21T06:15:35.387", "references": [{"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-8592/"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/inspiro/2.1.1/inc/admin/pluginInstaller/class-inspiro-plugin-installer.php#L67"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=284043%40inspiro%2F2.1.3&old=282419%40inspiro%2F2.1.2"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/ticket/228813"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20f461d1-aeb2-4913-804c-6a081e48765a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:59:42.348824+00:00", "value": {"mitigation_remediation": ["Update the Inspiro theme to version 2.1.3 or later, which corrects the nonce validation in the plugin installer.", "If an immediate upgrade is not possible, add define('DISALLOW_FILE_MODS', true); to wp\u2011config.php to block plugin installation and updates, disabling the vulnerable function.", "Educate site administrators to recognize and avoid phishing attempts that require them to click suspicious links, reducing the chance that an attacker can trick them into executing the request."], "summary": {"action": "Apply patch", "impact": "Cross\u2011Site Request Forgery enabling arbitrary plugin installation"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Inspiro theme version 2.1.2 or any earlier release are affected. The issue persists in all builds up to and including 2.1.2; the 2.1.3 release contains the fix that restores proper nonce validation. Site administrators should verify the theme version and upgrade promptly if they are on an impacted release.", "description_and_impact": "The Inspiro WordPress theme contains a missing nonce check in its plugin installer. This flaw permits an unauthenticated attacker to forge a request that, when executed by a logged\u2011in administrator, causes the theme to install any plugin from the repository. The result is arbitrary plugin installation, which can introduce malicious code into the site. The vulnerability is categorized as a Cross\u2011Site Request Forgery, listed as CWE\u2011352.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.1, classifying it as high severity. The EPSS score is below 1%, indicating a low likelihood that the vulnerability is actively exploited, and it is not currently listed in the CISA KEV catalog. An attacker can exploit it by sending a crafted link to an administrator, which, when clicked, initiates the vulnerable function. The required exploit is web\u2011based and relies on user interaction; thus sites with exposed administrative interfaces are realistic targets."}}}}, "created": "2025-08-21T12:58:56.350232+00:00", "updated": "2026-04-22T17:00:12.348452+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpzoom", "wpzoom$PRODUCT$inspiro"]}