What is the CVSS score of CVE-2025-54041?

CVE-2025-54041 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-54041

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-07-16 audit@patchstack.com

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.7.

AnalysisAI

Cross-site request forgery in WP Swings Wallet System for WooCommerce plugin through version 2.6.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious web pages. The vulnerability affects all installations of the plugin up to and including version 2.6.7, with no public exploit code identified at time of analysis, though the low EPSS score (0.02%) suggests minimal real-world exploitation likelihood despite the straightforward attack mechanism.

Technical ContextAI

The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of attack where an attacker tricks an authenticated user into performing unwanted actions on a target website without their knowledge or consent. The Wallet System for WooCommerce plugin, which extends WooCommerce functionality to manage cryptocurrency or digital wallet payments, lacks proper CSRF token validation on state-changing operations. This means the plugin fails to verify that requests modifying wallet balances, initiating transactions, or changing user settings originate from legitimate user interactions rather than attacker-controlled cross-origin requests. The plugin runs in the WordPress ecosystem (CPE context: WordPress plugin) where users are typically authenticated via browser cookies, making them vulnerable to CSRF exploitation if nonce verification is absent or improperly implemented.

Affected ProductsAI

Wallet System for WooCommerce plugin by WP Swings is vulnerable in all versions through 2.6.7. The plugin integrates with WooCommerce (WordPress e-commerce platform) and is distributed through the WordPress plugin repository. Affected installations include all active deployments using version 2.6.7 or earlier. The vulnerability does not affect specific WooCommerce or WordPress versions independently, only installations where the vulnerable plugin is active.

RemediationAI

Update the Wallet System for WooCommerce plugin to a version later than 2.6.7 immediately via the WordPress admin dashboard or directly from the plugin repository. WordPress site administrators should navigate to Plugins > Installed Plugins, locate Wallet System for WooCommerce, and click Update if available. If a patched version is not yet released in the official repository, disable the plugin temporarily until a security update is available. Review the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-6-7-cross-site-request-forgery-csrf-vulnerability for the exact patched version and release timeline. No active workarounds are applicable for CSRF vulnerabilities in WordPress plugins; patching is the only reliable mitigation.