What is the CVSS score of CVE-2025-49273?

CVE-2025-49273 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WP Tools are affected by CVE-2025-49273?

CVE-2025-49273 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions.

How to fix or mitigate CVE-2025-49273?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WP Tools CVE-2025-49273

EUVD-2025-17279 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires user interaction, no privileges for attacker; limited integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17279

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi WP Tools allows Cross Site Request Forgery. This issue affects WP Tools: from n/a through 5.24.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Tools up to version 5.24 allows unauthenticated attackers to trick authenticated administrators into unintentionally performing actions such as modifying plugin settings. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.03%).

Technical ContextAI

The vulnerability exists in the WP Tools WordPress plugin (CPE not explicitly available; EUVD indicates affected versions ≤5.24). It is a classic CSRF (CWE-352) issue, meaning the plugin does not properly verify the origin of state-changing requests, allowing an attacker to forge requests on behalf of a logged-in administrator if they can be tricked into clicking a link or visiting a malicious site. The underlying technology is PHP within the WordPress environment.

RemediationAI

No vendor-released patch version has been identified at the time of analysis. As an immediate mitigation, consider disabling or removing the WP Tools plugin until a fix is available. If removal is not feasible, implement a web application firewall (WAF) rule to filter or validate requests targeting WP Tools endpoints, though this is a compensating control and does not eliminate the underlying vulnerability. Monitor the Patchstack advisory for updates on a patched release.