What is the CVSS score of CVE-2025-59130?

CVE-2025-59130 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-59130

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.

AnalysisAI

Cross-site request forgery vulnerability in Appointify WordPress plugin versions up to 1.0.8 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious requests. The vulnerability affects a WordPress plugin used for appointment scheduling, enabling attackers to manipulate plugin functionality without explicit user consent. With an EPSS score of 0.02% (5th percentile), exploitation likelihood is minimal despite the technical severity classification.

Technical ContextAI

The vulnerability stems from insufficient CSRF token validation in the Appointify WordPress plugin (CWE-352: Cross-Site Request Forgery). WordPress plugins that fail to implement proper nonce verification or CSRF token checks are susceptible to this attack class, where an attacker can craft a malicious webpage or email containing requests that, when visited by an authenticated WordPress administrator or user with plugin permissions, execute unintended actions on behalf of that user. The Appointify plugin, which handles appointment scheduling functionality, lacks adequate request origin verification mechanisms across one or more sensitive endpoints. This allows attackers to exploit the implicit trust relationship between a user's browser and the WordPress site to trigger state-changing operations without the user's knowledge.

Affected ProductsAI

Appointify WordPress plugin is affected in versions through and including 1.0.8. The plugin is identified via CPE context as a WordPress plugin (WP plugin ecosystem) maintained by the Appointify project. All installations running Appointify version 1.0.8 or earlier are vulnerable to the CSRF attack vector.

RemediationAI

Update Appointify WordPress plugin to a version newer than 1.0.8 once a patched release becomes available. Consult the official Appointify plugin repository or Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/appointify/vulnerability/wordpress-appointify-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability for the specific patched version number and installation instructions. As an interim mitigation, site administrators can restrict plugin access to trusted users only and monitor WordPress audit logs for unexpected appointment modifications. Additionally, ensure WordPress nonce-based security best practices are enforced site-wide and consider using Content Security Policy (CSP) headers to reduce CSRF attack surface.