What is the CVSS score of CVE-2025-62112?

CVE-2025-62112 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62112

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-30 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Request Forgery.This issue affects Import into Easy Property Listings: from n/a through <= 2.2.1.

AnalysisAI

Cross-site request forgery (CSRF) vulnerability in the Easy Property Listings XML/CSV Import plugin for WordPress (versions <= 2.2.1) allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects the import functionality and carries minimal real-world exploitation risk based on EPSS scoring (0.02%, 5th percentile), indicating low likelihood of automated exploitation despite the CSRF vector requiring no special privileges or authentication from the attacker's perspective.

Technical ContextAI

This is a classic CSRF vulnerability (CWE-352) in a WordPress plugin that handles XML and CSV data import operations. The vulnerable component is the import functionality in Easy Property Listings, which likely accepts form submissions or API calls to process property data imports without proper anti-CSRF token validation (such as WordPress nonces). The attack exploits the stateless nature of HTTP requests by tricking an authenticated site administrator into unknowingly triggering malicious import actions through a crafted webpage or email link. The plugin's import feature processes sensitive real estate data, making CSRF attacks against authenticated administrators a potential vector for data manipulation or unauthorized bulk operations.

Affected ProductsAI

The vulnerability affects the Easy Property Listings XML/CSV Import plugin (identified by the vendor name Merv Barrett Import into Easy Property Listings) for WordPress in versions from inception through version 2.2.1 inclusive. The plugin is available through the WordPress plugin ecosystem and is identified in vulnerability databases under the package name easy-property-listings-xml-csv-import.

RemediationAI

Update the Easy Property Listings XML/CSV Import plugin to a version beyond 2.2.1 once available from the plugin vendor. Site administrators should navigate to the WordPress Plugins dashboard, locate the Easy Property Listings XML/CSV Import plugin, and apply the available update immediately. In the interim, restrict access to the plugin's import functionality by limiting admin account access and reducing the number of users with administrative privileges. Review WordPress security plugins or web application firewalls that can detect and block CSRF attack patterns. For detailed guidance, consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/easy-property-listings-xml-csv-import/vulnerability/wordpress-import-into-easy-property-listings-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability.