What is the CVSS score of CVE-2025-49435?

CVE-2025-49435 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wp Easy Allopass CVE-2025-49435

EUVD-2025-17144 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Attacker is unauthenticated (PR:N) but requires admin interaction (UI:R); only limited integrity impact from forged plugin actions, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17144

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass allows Cross Site Request Forgery. This issue affects Wp Easy Allopass: from n/a through 4.1.1.

AnalysisAI

Cross-site request forgery in the Wp Easy Allopass WordPress plugin (versions through 4.1.1) enables an unauthenticated remote attacker to forge state-changing requests on behalf of a logged-in WordPress administrator. The plugin, which integrates the Allopass micropayment gateway, lacks proper nonce validation on at least one administrative action handler, so a victim admin browsing a malicious page unknowingly triggers unauthorized plugin operations. No public exploit code has been identified and EPSS of 0.03% (7th percentile) signals negligible real-world exploitation probability at time of analysis.

Technical ContextAI

CSRF (CWE-352) arises when a web application processes state-changing requests without verifying that they originated from the application's own UI rather than a cross-origin page. WordPress plugins are expected to protect administrative POST handlers with WordPress nonces (wp_nonce_field / check_admin_referer); the absence of this check in Wp Easy Allopass allows a crafted form on an attacker-controlled origin to submit requests that the victim's authenticated browser session honors. The affected product is a WordPress plugin (wordpress-easy-allopass) by Hasina77, covering all published versions up to and including 4.1.1, per EUVD-2025-17144 and the Patchstack advisory. The Allopass service is a French micropayment provider, limiting realistic deployment to French-language or European e-commerce WordPress sites.

RemediationAI

The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wordpress-easy-allopass/vulnerability/wordpress-wp-easy-allopass-4-1-1-cross-site-request-forgery-csrf-vulnerability) should be consulted for an exact patched version; no specific fixed version number is present in the available intelligence data, so an upstream fix version cannot be independently confirmed. WordPress site operators running Wp Easy Allopass through 4.1.1 should update to the latest available plugin version immediately via the WordPress admin dashboard. As an interim compensating control if no patched version is available, deactivating the plugin eliminates the attack surface entirely, though this disables Allopass payment functionality. General hardening - ensuring WordPress administrators do not browse untrusted sites while logged in - reduces CSRF exposure broadly but is not a substitute for a proper nonce-based fix.