CVE-2025-9897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9897", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T23:29:24.475Z", "datePublished": "2025-10-03T11:17:23.245Z", "dateUpdated": "2026-04-08T17:33:40.477Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:40.477Z"}, "affected": [{"vendor": "hovanesvn", "product": "AP Background", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "AP Background <= 3.8.2 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php#L135"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-02T21:28:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:25:59.480278Z", "id": "CVE-2025-9897", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:26:09.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9897", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T18:25:59.480278Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:26:05.509Z"}}], "cna": {"title": "AP Background <= 3.8.2 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "hovanesvn", "product": "AP Background", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T21:28:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php#L135"}], "descriptions": [{"lang": "en", "value": "The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:40.477Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9897", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:40.477Z", "dateReserved": "2025-09-02T23:29:24.475Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:23.245Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AP Background", "vendor": "hovanesvn", "versions": [{"lessThanOrEqual": "3.8.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin AP Background para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 3.8.2, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n advParallaxBackAdminSaveSlider. Esto permite que atacantes no autenticados creen o modifiquen deslizadores de fondo a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-9897", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9897", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:25:59.480278Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:50.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php#L135"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:32:30.123425+00:00", "value": {"mitigation_remediation": ["Apply the official vendor patch that addresses the CSRF vulnerability (CWE-352) by upgrading to a version newer than 3.8.2.", "If an immediate upgrade is not possible, constrain administrator access to trusted IP addresses and enable two\u2011factor authentication to mitigate the risk of a forged request exploiting the missing nonce validation (CWE-352).", "Consider deactivating or uninstalling the AP Background plugin if it is not essential; otherwise, restrict its admin interfaces to authenticated users only and monitor for CSRF attempts using a security plugin."], "summary": {"action": "Patch plugin", "impact": "Unauthorized background slider manipulation via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress sites using the hovanesvn AP Background plugin version 3.8.2 or earlier. The specific vendor is hovanesvn and the affected product is the AP Background plugin for WordPress. No other versions are listed as vulnerable.", "description_and_impact": "The AP Background plugin for WordPress contains a CSRF flaw in the advParallaxBackAdminSaveSlider function due to missing or incorrect nonce validation. An attacker who tricks a logged\u2011in administrator into clicking a crafted URL can create or modify background sliders without authentication. The adversary can alter the appearance of the site by adding or changing background sliders.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. If the site admin is not protected by additional authentication mechanisms, the attack vector is a forged HTTP request; an attacker can trick an administrator into performing the request. However, the need to target a logged\u2011in administrator limits the attack scope to the site\u2019s admin users."}}}}, "created": "2025-10-06T14:43:12.669688+00:00", "updated": "2026-04-21T02:45:25.936892+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}