What is the CVSS score of CVE-2025-58918?

CVE-2025-58918 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Entrada WordPress Theme CVE-2025-58918

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-27 audit@patchstack.com

WordPress CSRF Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF needing no attacker privileges; victim must actively visit malicious page (UI:R); impact is limited write-side integrity only with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:15 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada entrada allows Cross Site Request Forgery.This issue affects Entrada: from n/a through <= 5.7.7.

AnalysisAI

Cross-Site Request Forgery in the Entrada WordPress theme (Waituk, versions through 5.7.7) enables a remote unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated user into visiting a crafted page. The missing or insufficient nonce validation on sensitive form or AJAX endpoints allows the victim's browser to unwittingly submit forged requests, resulting in limited integrity impact. With an EPSS score of 0.01% (3rd percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world risk is low despite the network-accessible vector.

Technical ContextAI

Entrada is a WordPress theme developed by Waituk, affected through version 5.7.7. CWE-352 (Cross-Site Request Forgery) arises when state-changing HTTP requests lack origin verification, allowing a third-party site to forge requests that execute in the context of an authenticated user's session. In WordPress, the canonical mitigation is wp_nonce generation and verification on all state-mutating form submissions and AJAX handlers. The absence of this check means any page load or script on an attacker-controlled origin can silently submit authenticated requests. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-delivered, low complexity, requires no attacker privileges, but does depend on victim interaction. No CPE string was provided in the source data.

Affected ProductsAI

The Entrada WordPress theme by Waituk is affected from an unspecified base version through and including version 5.7.7. No CPE string was provided in the available data. The Patchstack advisory documenting this issue is available at https://patchstack.com/database/WordPress/Theme/entrada/vulnerability/wordpress-entrada-theme-5-7-7-cross-site-request-forgery-csrf-vulnerability. No independent vendor advisory from Waituk was identified in the provided references.

RemediationAI

Update the Entrada theme to a version beyond 5.7.7 if a patched release has been issued by Waituk - consult the Patchstack advisory at https://patchstack.com/database/WordPress/Theme/entrada/vulnerability/wordpress-entrada-theme-5-7-7-cross-site-request-forgery-csrf-vulnerability for confirmed fix version details. A patched version is not independently confirmed from the data provided. If no patch is yet available, restrict wp-admin access to trusted IP ranges to reduce exposure of authenticated sessions, and consider enabling a WAF rule that validates the HTTP Referer header on POST requests to WordPress admin endpoints - note this may break legitimate cross-origin integrations. Temporarily deactivating the theme pending a vendor fix is the most conservative compensating control if the site can tolerate downtime.