What is the CVSS score of CVE-2025-13924?

CVE-2025-13924 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Advanced Product Fields CVE-2025-13924

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-09 security@wordfence.com

WordPress CSRF Woocommerce Wordpress Plugin

4.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Unauthenticated attacker but requires admin to click a link (PR:N, UI:R); CSRF yields only limited integrity change (duplicate/publish field groups), so I:L with C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 11:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 10:49 vuln.today

CVE Published

Dec 09, 2025 - 18:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-site request forgery in the WordPress plugin Advanced Product Fields (Product Addons) for WooCommerce, affecting all versions up to and including 1.6.17, allows an unauthenticated attacker to duplicate and publish existing product field groups - including ones still in draft or pending status - by inducing a logged-in administrator to load an attacker-controlled page or link. The flaw is a missing nonce check in the plugin's 'maybe_duplicate' function (CWE-352); exploitation is remote and unauthenticated on the attacker's side but requires the victim administrator to interact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3), and impact is limited to integrity of field-group records since the attacker can replicate and publish existing groups but cannot inject arbitrary content. EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; this is a genuinely low-priority issue despite the network attack vector, with administrator user interaction as the primary limiting factor.

Technical ContextAI

The affected component is a WordPress plugin that extends WooCommerce with configurable product add-on fields (Advanced Product Fields / Product Addons). The vulnerable code path is the plugin's 'maybe_duplicate' routine, which handles duplication of product field groups and is invoked through a WordPress admin request handler without a valid nonce check (CWE-352, Cross-Site Request Forgery). WordPress nonces are the framework's standard anti-CSRF token mechanism for state-changing admin actions; because the nonce validation is missing or incorrect on this handler, a request crafted by a third-party site is indistinguishable from a legitimate administrator action. The reference to class-admin-controller.php lines 130-133 in the upstream GitHub mirror points at the admin controller logic that performs the duplication, and the WordPress.org changeset 3411740 reflects the upstream code change addressing the handler. No CPE identifiers were supplied in the input data, so affected scope is defined by the plugin slug and version range rather than by CPE matching. The request vector is network-based (AV:N) with no privileges required for the attacker (PR:N), but the action only succeeds in the security context of an authenticated administrator session, hence the UI:R rating and the low integrity-only impact (I:L, no confidentiality or availability effect).

Affected ProductsAI

Advanced Product Fields (Product Addons) for WooCommerce - the WordPress plugin published on the WordPress.org plugin repository (also mirrored at github.com/Baodaica/advanced-product-fields-for-woocommerce) - is affected in all versions up to and including 1.6.17, as installed on WordPress sites running WooCommerce that have the plugin active. No CPE strings were provided in the intelligence feed, so identification should be done by plugin slug and installed version rather than by CPE. The vulnerable code is the 'maybe_duplicate' function in the plugin's admin controller (referenced upstream at class-admin-controller.php lines 130-133), and the corresponding fix is captured in the WordPress.org changeset at https://plugins.trac.wordpress.org/changeset/3411740/. Any site running the plugin at version 1.6.17 or earlier with at least one administrator account is in scope; sites that do not use the plugin, or that have already moved past 1.6.17, are unaffected.

RemediationAI

Apply the upstream fix by updating Advanced Product Fields (Product Addons) for WooCommerce to a release newer than 1.6.17 - the code change is published as WordPress.org changeset 3411740 (https://plugins.trac.wordpress.org/changeset/3411740/), which is the authoritative patch reference; because the input data does not state the exact tagged patched version, confirm the fixed version in the plugin's changelog before or after updating, and treat update status as 'Upstream fix committed in the plugin repository (changeset 3411740); a specific patched release version is not independently confirmed.' If updates cannot be applied immediately, the most effective compensating control is to deactivate the plugin entirely - accepting the loss of its product add-on functionality - since the vulnerable handler is only reachable while the plugin is active. Alternatively, restrict the attack surface and the human trigger: enforce administrator sessions over HTTPS only, avoid browsing untrusted sites while logged into wp-admin, and log out of admin sessions when not in use; deploying a WAF or WordPress security plugin with CSRF/origin-referer rules for admin-ajax and admin-post requests can block forged cross-site requests but adds false-positive risk on legitimate admin actions and should be tested before enforcement. Browser-level SameSite cookie handling reduces (but does not reliably eliminate) the CSRF window and cannot be relied on as the sole mitigation. Additional advisory context is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8906333-7024-40d3-91cd-2ecbbf20314f?source=cve. Patching is low-urgency given the bounded impact (duplication/publication of existing field groups only) but should still be scheduled, since the request is unauthenticated (PR:N) and requires only a single administrator click (UI:R).