CVE-2026-25015

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25015", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:51:50.023Z", "datePublished": "2026-02-03T14:08:39.297Z", "dateUpdated": "2026-04-28T16:14:53.665Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "userswp", "product": "UsersWP", "vendor": "Stiofan", "versions": [{"changes": [{"at": "1.2.54", "status": "unaffected"}], "lessThanOrEqual": "1.2.53", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tristan Jay Neale | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:59.460Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.<p>This issue affects UsersWP: from n/a through <= 1.2.53.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:53.665Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/userswp/vulnerability/wordpress-userswp-plugin-1-2-53-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "title": "WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T16:15:18.112823Z", "id": "CVE-2026-25015", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:47:09.367Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25015", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:51:50.023Z", "datePublished": "2026-02-03T14:08:39.297Z", "dateUpdated": "2026-04-28T12:47:09.367Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "userswp", "product": "UsersWP", "vendor": "Stiofan", "versions": [{"changes": [{"at": "1.2.54", "status": "unaffected"}], "lessThanOrEqual": "1.2.53", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tristan Jay Neale | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-28T13:26:35.636Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.<p>This issue affects UsersWP: from n/a through <= 1.2.53.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:48.347Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/userswp/vulnerability/wordpress-userswp-plugin-1-2-53-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "title": "WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25015", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T16:15:18.112823Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T16:15:12.873Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "userswp", "product": "UsersWP", "vendor": "Stiofan", "versions": [{"changes": [{"at": "1.2.54", "status": "unaffected"}], "lessThanOrEqual": "1.2.53", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53."}, {"lang": "es", "value": "Falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) vulnerabilidad en Stiofan UsersWP userswp permite falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Este problema afecta a UsersWP: desde n/a hasta &lt;= 1.2.53."}], "id": "CVE-2026-25015", "lastModified": "2026-06-17T10:23:59.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25015", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T16:15:18.112823Z", "version": "2.0.3"}}]}, "published": "2026-02-03T15:16:19.737", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/userswp/vulnerability/wordpress-userswp-plugin-1-2-53-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:11:53.735109+00:00", "value": {"mitigation_remediation": ["Update UsersWP to the latest patch (\u2265\u202f1.2.54) which removes the CSRF flaw.", "If an immediate upgrade is impossible, restrict the plugin\u2019s administrative endpoints to IP addresses or 2FA\u2011protected roles to reduce the window of opportunity for an attacker.", "Enable WordPress\u2019 built\u2011in nonce verification for all plugin forms and set the SameSite cookie attribute to Strict or Lax to mitigate CSRF attempts."], "summary": {"action": "Monitor", "impact": "Cross-site request forgery"}, "threat_synthesis": {"affected_systems": "Stiofan\u2019s UsersWP plugin, versions from an unspecified earliest release through 1.2.53 inclusive, is affected. The vulnerability is scoped to the plugin\u2019s request handling code rather than the core WordPress installation. Any WordPress site that has the plugin installed at a version \u2264\u202f1.2.53 is potentially exposed.", "description_and_impact": "Cross\u2011Site Request Forgery (CWE\u2011352) is present in the UsersWP plugin for WordPress. The flaw allows an attacker to trick an authenticated user into initiating requests that the plugin will process, potentially changing user data or performing privileged actions without the user\u2019s knowledge. The experimental CVSS score of 4.3 reflects a moderate impact when an attacker can gain the victim\u2019s authentication state.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates that the security loss is moderate; however, the EPSS score of less than\u202f1\u202fpercent reveals that the likelihood of observed exploitation is low. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented, widespread exploitation. Attackers would typically require the victim to be logged in and follow a crafted link or be lured to a page that submits a hidden form, which is a commonly employed CSRF attack pattern. No public exploit has yet been reported, but the low probability does not eliminate the risk for high\u2011value sites."}}}}, "created": "2026-02-04T12:09:16.529210+00:00", "updated": "2026-04-16T01:15:20.534858+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}