Wordpress Plugin CVE-2025-57931

While CVSS scoring is unavailable, the vulnerability characteristics suggest moderate attack complexity: CSRF requires both victim interaction and prior authentication. The extremely low EPSS score (0.02%, percentile 4%) indicates negligible real-world exploitation likelihood despite the theoretical risk. No KEV confirmation or public exploit code availability was identified, further supporting low active threat status. SSVC framing shows exploitation is possible but not automated (requires social engineering to trick an admin into visiting a malicious page), and technical impact is limited to plugin configuration rather than remote code execution or data theft. This is a classic example of a valid vulnerability with significant real-world risk gap-patch it during normal maintenance cycles, but it does not warrant emergency response.

An attacker creates a malicious webpage containing hidden HTML forms or JavaScript that targets the Ays Pro Popup box plugin's admin endpoints (e.g., to disable the plugin, modify popup content, or inject malicious code into popups). When a site administrator visits the attacker's page while logged into WordPress, the browser automatically includes the admin's session cookies, causing the unprotected admin action to execute without the administrator's knowledge. This could result in defaced popups, data harvesting, or lateral privilege escalation if the popup system is chained with other plugin vulnerabilities. No public exploit code or active exploitation in the wild has been confirmed, reducing practical risk.