What is the CVSS score of CVE-2025-62084?

CVE-2025-62084 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Imdad Next Web CVE-2025-62084

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through <= 2.3.1.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in iNext Woo Pincode Checker WordPress plugin versions up to 2.3.1 allows unauthenticated attackers to perform unauthorized actions on behalf of site administrators or users. The plugin fails to implement proper nonce validation on sensitive operations, enabling an attacker to craft malicious web pages that, when visited by an authenticated user, execute unintended requests against the vulnerable plugin. This is a low-severity finding with an EPSS score of 0.02% (5th percentile), indicating minimal real-world exploitation probability despite the theoretical attack surface.

Technical ContextAI

The vulnerability stems from improper implementation of Cross-Site Request Forgery protections in the WordPress plugin architecture (CWE-352). WordPress provides native CSRF protection through nonces (number used once), cryptographic tokens that validate that form submissions and AJAX requests originate from legitimate in-application sources rather than cross-origin forgery attacks. The iNext Woo Pincode Checker plugin, used to validate postal codes for WooCommerce e-commerce functionality, fails to properly implement these nonces on one or more administrative or user-facing operations. The affected product is a WordPress plugin (CPE context: WordPress plugin ecosystem) that integrates with WooCommerce, a popular e-commerce framework. Without proper nonce validation, attackers can construct cross-origin requests that execute plugin functionality if a logged-in user visits a malicious webpage.

Affected ProductsAI

iNext Woo Pincode Checker WordPress plugin versions from an unspecified baseline through version 2.3.1 and earlier are affected. This is a WordPress plugin (product family: imdad Next Web iNext Woo Pincode Checker) that extends WooCommerce functionality. The exact vulnerable versions are not granularly specified in the available data; the advisory states the vulnerability affects versions up to and including 2.3.1. Additional details and version history are available in the Patchstack vulnerability database entry.

RemediationAI

Update iNext Woo Pincode Checker to a patched version released after 2.3.1. Consult the official Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/inext-woo-pincode-checker/vulnerability/wordpress-inext-woo-pincode-checker-plugin-2-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for the specific patched version number and installation instructions. As an interim mitigation while a patch is being prepared or applied, administrators should restrict plugin access to trusted users only, monitor for suspicious administrative activity, and educate users to avoid clicking untrusted links while logged into the WordPress administration panel. WordPress site administrators should verify that the WordPress security headers (X-Frame-Options, Content-Security-Policy) are properly configured to provide additional CSRF defense.