What is the CVSS score of CVE-2025-49291?

CVE-2025-49291 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Calculated Fields Form are affected by CVE-2025-49291?

CVE-2025-49291 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions.

How to fix or mitigate CVE-2025-49291?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Calculated Fields Form CVE-2025-49291

EUVD-2025-17271 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress CSRF Calculated Fields Form Wordpress Plugin Codepeople

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Matches provided vector; requires user interaction (UI:R) and no privileges (PR:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 13:32 vuln.today

Severity Changed

Apr 23, 2026 - 15:42 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:42 NVD

8.8 (HIGH) 4.3 (MEDIUM)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17271

CVE Published

Jun 06, 2025 - 13:15 cve.org

MEDIUM 4.3

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 8.8

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n/a through 5.3.58.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.

Technical ContextAI

The vulnerability is a Cross-Site Request Forgery (CSRF) issue (CWE-352) in the Calculated Fields Form plugin for WordPress. CSRF attacks exploit the trust a web application has in an authenticated user's browser, allowing an attacker to forge requests that perform state-changing operations on behalf of the victim. The affected product is a WordPress plugin used to create dynamic forms with calculations. The CPE string cpe:2.3:a:codepeople:calculated_fields_form:*:*:*:*:*:wordpress:*:* indicates all versions up to 5.3.58 are affected.

RemediationAI

Update the Calculated Fields Form plugin to version 5.3.59 or later, which contains the fix. The vendor advisory is available at the Patchstack link. As a workaround, administrators can implement CSRF tokens or use WordPress nonces, but the best practice is to apply the patch. No other workarounds are documented.