CVE-2025-23823
Published: 16 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-23823 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CNZZ&51LA for WordPress plugin (cnzz51la-for-wordpress). This issue affects the plugin from unknown initial versions through version 1.0.1. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting high severity due to network accessibility, low complexity, no required privileges, and changed scope despite needing user interaction.
Attackers can exploit this CSRF flaw without privileges by crafting malicious webpages or links that trick authenticated WordPress users (with appropriate access to the plugin) into unwittingly submitting forged requests. Exploitation requires the victim to interact, such as visiting a malicious site while logged in. Successful attacks can result in low impacts to confidentiality, integrity, and availability, potentially enabling unauthorized actions within the plugin's scope.
The Patchstack advisory provides further details on mitigation, describing the issue as a CSRF-to-stored-XSS vulnerability in version 1.0.1; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/cnzz51la-for-wordpress/vulnerability/wordpress-cnzz-51la-for-wordpress-plugin-1-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve for patch information and remediation steps.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) via forged requests from malicious links/pages, leading to unauthorized actions and stored XSS.