Wordpress Plugin CVE-2025-62107

Risk assessment is constrained by missing CVSS vector data; however, multiple signals indicate low real-world priority. The EPSS score of 0.02% (5th percentile) strongly suggests minimal exploitation probability in the wild. Without a CVSS vector, attack complexity and privilege requirements cannot be directly confirmed, but typical CSRF vulnerabilities require user interaction (visiting attacker-controlled site while authenticated), which limits automatable exploitation and reduces technical impact scope. The absence of public exploit code and no KEV designation further supports a lower-threat classification. For WordPress sites, the actual risk depends on the specific functionality exposed by Feather Login Page; if the plugin only handles login/registration flows, impact may be limited to account creation or settings changes rather than full site compromise. Organizations should prioritize patching only if using Feather Login Page in environments where user-initiated cross-origin actions pose operational risk.

An attacker registers a malicious website or injects malicious JavaScript into a legitimate compromised site and tricks a WordPress administrator (or user with privileges in the vulnerable plugin's functionality) into visiting the attacker's page while logged into their WordPress site. The attacker's page contains a hidden form that submits a request to the WordPress site (e.g., modifying plugin settings or creating unauthorized accounts), which the browser automatically includes the user's session cookies for, causing the action to execute without the user's explicit consent or awareness. No technical sophistication is required, and success depends entirely on social engineering to lure the target to the attacker's site.