CVE-2025-9948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9948", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-03T13:33:11.490Z", "datePublished": "2025-09-30T03:35:30.655Z", "dateUpdated": "2026-04-08T17:18:06.808Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:06.808Z"}, "affected": [{"vendor": "paulq", "product": "Chat by Chatwee", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L41"}, {"url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L10"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-29T15:21:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:31:53.253662Z", "id": "CVE-2025-9948", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:32:03.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9948", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T15:31:53.253662Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:31:57.218Z"}}], "cna": {"title": "Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "paulq", "product": "Chat by Chatwee", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T15:21:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L41"}, {"url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L10"}], "descriptions": [{"lang": "en", "value": "The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-30T03:35:30.655Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9948", "state": "PUBLISHED", "dateUpdated": "2025-09-30T15:32:03.468Z", "dateReserved": "2025-09-03T13:33:11.490Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-30T03:35:30.655Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Chat by Chatwee", "vendor": "paulq", "versions": [{"lessThanOrEqual": "2.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Chat by Chatwee para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.1.3, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la p\u00e1gina de configuraci\u00f3n de administraci\u00f3n. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-9948", "lastModified": "2026-06-17T10:10:08.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9948", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:31:53.253662Z", "version": "2.0.3"}}]}, "published": "2025-09-30T11:37:47.570", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L10"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L41"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:26:24.416444+00:00", "value": {"mitigation_remediation": ["Upgrade the Chat by Chatwee plugin to version 2.1.4 or later.", "Instruct administrators to avoid clicking suspicious links or unfamiliar URLs.", "For organizations that cannot immediately update, monitor administrative traffic for unexpected changes or unauthorized settings updates."], "summary": {"action": "Patch immediately", "impact": "Cross\u2011Site Request Forgery leading to unauthorized plugin settings modification"}, "threat_synthesis": {"affected_systems": "This issue applies to the WordPress Chat by Chatwee plugin version 2.1.3 and all earlier releases. Administrators who have installed any of those plugin versions on their sites are affected.", "description_and_impact": "The Chat by Chatwee plugin for WordPress versions up to 2.1.3 suffers from a missing or incorrect nonce check on the admin settings page, which allows an unauthenticated attacker to modify plugin settings if they can trick a site administrator into clicking a link. The attacker could change configuration options to their advantage or create a stepping\u2011stone for further exploitation, although the vulnerability itself does not allow direct code execution.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering \u2013 the attacker must lure an administrator into submitting a forged request, so the risk is largely dependent on the likelihood of such a social\u2011engineering attack."}}}}, "created": "2025-09-30T08:47:17.993484+00:00", "updated": "2026-04-20T19:30:06.168340+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}