Cyber Posture

CVE-2025-23823

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0014 33.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-23823 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CNZZ&51LA for WordPress plugin (cnzz51la-for-wordpress). This issue affects the plugin from unknown initial versions through version 1.0.1. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting high severity due to network accessibility, low complexity, no required privileges, and changed scope despite needing user interaction.

Attackers can exploit this CSRF flaw without privileges by crafting malicious webpages or links that trick authenticated WordPress users (with appropriate access to the plugin) into unwittingly submitting forged requests. Exploitation requires the victim to interact, such as visiting a malicious site while logged in. Successful attacks can result in low impacts to confidentiality, integrity, and availability, potentially enabling unauthorized actions within the plugin's scope.

The Patchstack advisory provides further details on mitigation, describing the issue as a CSRF-to-stored-XSS vulnerability in version 1.0.1; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/cnzz51la-for-wordpress/vulnerability/wordpress-cnzz-51la-for-wordpress-plugin-1-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve for patch information and remediation steps.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) via forged requests from malicious links/pages, leading to unauthorized actions and stored XSS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References