What is the CVSS score of CVE-2025-5932?

CVE-2025-5932 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Homerunner CVE-2025-5932

EUVD-2025-28695 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-26 security@wordfence.com

WordPress CSRF Homerunner Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:47 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-28695

CVE Published

Jun 26, 2025 - 03:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.29. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.