CVE-2026-25411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25411", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:53:19.001Z", "datePublished": "2026-02-19T08:27:05.876Z", "dateUpdated": "2026-04-28T16:14:58.148Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "revision-manager-tmc", "product": "Revision Manager TMC", "vendor": "themastercut", "versions": [{"lessThanOrEqual": "2.8.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:08.955Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.<p>This issue affects Revision Manager TMC: from n/a through <= 2.8.22.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:58.148Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/revision-manager-tmc/vulnerability/wordpress-revision-manager-tmc-plugin-2-8-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "title": "WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T18:42:21.819596Z", "id": "CVE-2026-25411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T13:23:32.250Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T18:42:21.819596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T18:41:41.988Z"}}], "cna": {"title": "WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery"}]}], "affected": [{"vendor": "themastercut", "product": "Revision Manager TMC", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 2.8.22"}], "packageName": "revision-manager-tmc", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-02-19T09:26:05.630Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/revision-manager-tmc/vulnerability/wordpress-revision-manager-tmc-plugin-2-8-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.<p>This issue affects Revision Manager TMC: from n/a through <= 2.8.22.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-02-19T08:27:05.876Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25411", "state": "PUBLISHED", "dateUpdated": "2026-02-19T18:43:10.425Z", "dateReserved": "2026-02-02T12:53:19.001Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:27:05.876Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "revision-manager-tmc", "product": "Revision Manager TMC", "vendor": "themastercut", "versions": [{"lessThanOrEqual": "2.8.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en themastercut Revision Manager TMC revision-manager-tmc permite la falsificaci\u00f3n de petici\u00f3n en sitios cruzados. Este problema afecta a Revision Manager TMC: desde n/a hasta &lt;= 2.8.22."}], "id": "CVE-2026-25411", "lastModified": "2026-06-17T10:24:35.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25411", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T18:42:21.819596Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:22.910", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/revision-manager-tmc/vulnerability/wordpress-revision-manager-tmc-plugin-2-8-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.22]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Revision Manager TMC", "source": "cna", "vendor": "themastercut"}, "product": "revision_manager_tmc", "vendor": "themastercut"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:30:23.256921+00:00", "value": {"mitigation_remediation": ["Update the Revision Manager TMC plugin to a version that includes CSRF protection.", "If an immediate upgrade is not possible, add CSRF safeguards such as a nonce or validate the Origin/Referer headers on state\u2011changing endpoints to mitigate forged requests.", "Ensure that the WordPress installation uses secure authentication practices, including two\u2011factor authentication, to limit the impact of a compromised session."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery allowing attackers to trigger privileged actions on behalf of authenticated users"}, "threat_synthesis": {"affected_systems": "Vulnerable systems are those running the themastercut Revision Manager TMC WordPress plugin version 2.8.22 or earlier. These affected releases span all revisions up to and including 2.8.22, with no further version boundary specified.", "description_and_impact": "The Revision Manager TMC plugin for WordPress is impacted by a Cross\u2011Site Request Forgery (CWE\u2011352) flaw. The flaw allows an attacker to cause an authenticated WordPress user to unknowingly send requests that invoke privileged plugin actions, such as creating or altering revision data. Based on the description, it is inferred that an attacker could manipulate or delete revision content, thereby compromising the integrity of the site\u2019s content management. No remote code execution is possible without a separate vulnerability.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. The EPSS of < 1% suggests exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the CSRF nature of the flaw, it is inferred that the attack vector would involve a malicious link or page that submits a forged request to the plugin over the victim\u2019s authenticated session. Successful exploitation would allow the attacker to perform authorized actions without needing direct access to the administrative interface."}}}}, "created": "2026-02-20T10:08:23.998796+00:00", "updated": "2026-04-16T06:45:16.303702+00:00", "vendors": ["themastercut", "themastercut$PRODUCT$revision_manager_tmc", "wordpress", "wordpress$PRODUCT$wordpress"]}