What is the CVSS score of CVE-2025-49283?

CVE-2025-49283 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress Anti-spam Plugin CVE-2025-49283

EUVD-2025-17278 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Matches provided vector: network-delivered CSRF requires victim interaction; limited integrity impact only; no C or A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17278

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant allows Cross Site Request Forgery. This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through 4.1.1.

AnalysisAI

Cross-site request forgery in the 'Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant' WordPress plugin (versions through 4.1.1) allows a remote unauthenticated attacker to perform unauthorized plugin configuration changes by tricking an authenticated WordPress administrator into clicking a crafted link or visiting a malicious page. The vulnerability stems from missing or insufficient CSRF token validation on plugin action handlers, enabling integrity-impacting changes - such as disabling spam protection or altering reCaptcha settings - without the administrator's knowledge. No public exploit has been identified at time of analysis, and EPSS at 0.03% (7th percentile) reflects very low observed exploitation interest.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) occurs when a web application fails to verify that a state-changing HTTP request originates from the legitimate user's own session rather than a third-party page. In WordPress plugins, CSRF protection is conventionally implemented via nonce values generated by wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce(). The affected product is a WordPress plugin providing anti-spam filtering, Google reCaptcha integration, and GDPR-compliance tooling for various form types (contact, login, registration, comment). Affected CPE corresponds to versions n/a through 4.1.1 of the plugin authored by Matthias Nordwig. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a web-delivered forgery requiring victim interaction (UI:R) with limited integrity impact and no confidentiality or availability consequences.

RemediationAI

Users should upgrade to a version of the plugin beyond 4.1.1 once a patched release becomes available from the plugin author; the exact fixed version is not confirmed in available data - monitor the WordPress.org plugin page for Matthias Nordwig's plugin and the Patchstack advisory at patchstack.com/database/wordpress/plugin/gdpr-compliant-recaptcha-for-all-forms for a confirmed fixed release. As an interim compensating control, site administrators should avoid clicking unsolicited links while authenticated to their WordPress dashboard, enforce strong browser session hygiene (log out when not in use), and consider temporarily deactivating the plugin if anti-spam coverage can be supplied by an alternative until patching is feasible. Additionally, a web application firewall rule blocking cross-origin POST requests to wp-admin endpoints can reduce CSRF exposure surface, though this may interfere with legitimate third-party integrations.