CVE-2025-28856

CVE-2025-28856 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the WordPress plugin W3Counter Free Real-Time Web Stats (blog-stats-by-w3counter) developed by dangrossman. The issue affects the plugin from unknown initial versions through version 4.1 inclusive. Published on 2025-03-11, it carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no required privileges, and user interaction needed.

Attackers can exploit this vulnerability remotely by tricking authenticated users into visiting a malicious site or clicking a forged link, leading to unauthorized actions on the victim's behalf. No privileges are required on the attacker's part, but exploitation depends on user interaction such as loading a malicious webpage. Successful attacks result in low integrity impact, potentially allowing modification of plugin-related data or settings without affecting confidentiality or availability.

The Patchstack advisory provides details on this vulnerability in the WordPress plugin, including assessment and recommended actions for mitigation. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve for patching guidance and verification steps.