CVE-2025-9622

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9622", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-28T19:04:23.342Z", "datePublished": "2025-09-10T06:38:49.546Z", "dateUpdated": "2026-04-08T17:17:49.411Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:49.411Z"}, "affected": [{"vendor": "wpblast", "product": "WP Blast | SEO & Performance Booster", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L914"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L922"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L930"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357450%40wpblast&new=3357450%40wpblast&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-06T16:22:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-09T17:58:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T20:31:38.984869Z", "id": "CVE-2025-9622", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:31:46.155Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9622", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T20:31:38.984869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:31:43.052Z"}}], "cna": {"title": "WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wpblast", "product": "WP Blast | SEO & Performance Booster", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-06T16:22:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-09T17:58:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L914"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L922"}, {"url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L930"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357450%40wpblast&new=3357450%40wpblast&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:49.411Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9622", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:49.411Z", "dateReserved": "2025-08-28T19:04:23.342Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:49.546Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Blast | SEO & Performance Booster", "vendor": "wpblast", "versions": [{"lessThanOrEqual": "1.8.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9622", "lastModified": "2026-06-17T10:09:23.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9622", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T20:31:38.984869Z", "version": "2.0.3"}}]}, "published": "2025-09-10T07:15:46.500", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L914"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L922"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L930"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357450%40wpblast&new=3357450%40wpblast&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:07:58.815601+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Blast plugin to a version newer than 1.8.6, which has correct nonce validation implemented.", "If an immediate update is not possible, limit cache clearing, sitemap clearing, plugin data purging, and score resetting actions to administrators only and add confirmation prompts to reduce accidental execution.", "Consult the plugin maintainers for an official fix or temporary guidance if the latest version is not available."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011site request forgery allowing cache and data clearing by an unauthenticated attacker"}, "threat_synthesis": {"affected_systems": "All WordPress installations that have the WP Blast | SEO & Performance Booster plugin version 1.8.6 or earlier are affected. No higher versions are listed as vulnerable in the CVE record.", "description_and_impact": "The WP Blast | SEO & Performance Booster plugin contains a CSRF flaw in its Settings functions caused by missing or incorrect nonce validation. An attacker who can lure an administrator into clicking a crafted link can cause the site to purge its cache, clear the sitemap, delete plugin data, or reset SEO scoring. The flaw does not provide direct data theft or system compromise, but it disrupts administrative functions that affect site performance and search\u2011engine visibility.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to successfully perform a CSRF attack, which typically relies on social engineering to trick an administrator into submitting a forged request. While the impact is limited to non\u2011critical administrative actions, it can still disturb site operation and user experience."}}}}, "created": "2025-09-11T10:42:51.577968+00:00", "updated": "2026-04-21T03:15:16.332327+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}