EUVD-2025-28324Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Requires user interaction for successful exploitation; only integrity impact, no confidentiality or availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings allows Cross Site Request Forgery. This issue affects Advanced Settings: from n/a through 3.0.1.
AnalysisAI
Unauthorized settings changes in the Advanced Settings WordPress plugin through version 3.0.1 via Cross-Site Request Forgery allow attackers to perform state-altering actions on behalf of a logged-in administrator. The flaw stems from missing CSRF token validation on privileged requests, requiring user interaction to exploit. With a CVSS score of 4.3, a very low EPSS (0.03%) and no known active exploitation or public exploit, the immediate risk is low.
Technical ContextAI
The vulnerability resides in the Advanced Settings WordPress plugin, written in PHP, which lacks anti-CSRF nonces on administrative action endpoints. This violates CWE-352 (Cross-Site Request Forgery), allowing an attacker to craft a malicious request that, if triggered by an authenticated administrator, manipulates plugin settings. The affected component is the plugin's settings update handler accessible via the WordPress admin interface. The CVSS vector confirms network attack vector and low complexity, but user interaction is mandatory.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As an immediate mitigation, remove the Advanced Settings plugin from WordPress sites or restrict administrative sessions to dedicated, trusted browsers. Enable SameSite cookie attributes and consider implementing a Web Application Firewall rule to detect CSRF patterns targeting the plugin’s admin endpoints. Monitor the official WordPress plugin repository or Patchstack for an update that adds CSRF nonce protection.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today