CVE-2025-9896

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9896", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T23:17:39.312Z", "datePublished": "2025-09-27T06:47:13.427Z", "dateUpdated": "2026-04-08T16:38:04.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:04.783Z"}, "affected": [{"vendor": "funnnny", "product": "HidePost", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "HidePost <= 2.3.8 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a618dbf-1180-4937-8466-5abc784a3365?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/hidepost/tags/2.3.8/options.php#L7"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "timeline": [{"time": "2025-09-26T18:33:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T19:04:56.932544Z", "id": "CVE-2025-9896", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:05:06.668Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9896", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-29T19:04:56.932544Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:05:02.969Z"}}], "cna": {"title": "HidePost <= 2.3.8 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "funnnny", "product": "HidePost", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T18:33:02.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a618dbf-1180-4937-8466-5abc784a3365?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/hidepost/tags/2.3.8/options.php#L7"}], "descriptions": [{"lang": "en", "value": "The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-27T06:47:13.427Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9896", "state": "PUBLISHED", "dateUpdated": "2025-09-29T19:05:06.668Z", "dateReserved": "2025-09-02T23:17:39.312Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-27T06:47:13.427Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HidePost", "vendor": "funnnny", "versions": [{"lessThanOrEqual": "2.3.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin HidePost para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.3.8, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la p\u00e1gina de configuraci\u00f3n options.php. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-9896", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9896", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-29T19:04:56.932544Z", "version": "2.0.3"}}]}, "published": "2025-09-27T07:15:34.667", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/hidepost/tags/2.3.8/options.php#L7"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a618dbf-1180-4937-8466-5abc784a3365?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:16:54.871197+00:00", "value": {"mitigation_remediation": ["Upgrade the HidePost plugin to the latest version (greater than 2.3.8) which restores proper nonce validation.", "If an immediate upgrade is not possible, remove or deactivate HidePost to eliminate the vulnerable code path.", "Maintain overall WordPress and plugin updates and consider additional security testing for CSRF vulnerabilities."], "summary": {"action": "Apply Update", "impact": "Unauthenticated Cross\u2011Site Request Forgery that allows an attacker to alter HidePost settings"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the HidePost WordPress plugin from the vendor funnnny, specifically all releases up to and including version 2.3.8. WordPress sites that have this plugin installed and are running those version numbers are susceptible.", "description_and_impact": "The HidePost plugin suffers from missing or incorrect nonce validation on its options.php settings page. This flaw lets an unauthenticated attacker forge a request that, if an administrator performs a simple action such as clicking a link, will modify the plugin\u2019s configuration. The change can influence how posts are hidden or shown, potentially altering site content visibility. The underlying weakness is classified as a Cross\u2011Site Request Forgery, CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium impact when the flaw is exploited. The EPSS score of less than 1% suggests that exploitation is currently very unlikely. The flaw is not listed in the CISA KEV catalog. An attacker would need to compromise the administrative browser session of a site owner or trick an administrator into following a malicious URL that performs the forged request. Once executed, the attacker can alter plugin settings without needing further privileges."}}}}, "created": "2025-09-29T09:29:50.959131+00:00", "updated": "2026-04-22T14:30:18.952631+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}