What is the CVSS score of CVE-2025-62133?

CVE-2025-62133 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62133

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/a through <= 1.4.1.

AnalysisAI

FormFacade WordPress plugin version 1.4.1 and earlier contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. The vulnerability requires user interaction (clicking a malicious link) but can lead to modification of plugin settings or data depending on affected functionality. EPSS exploitation probability is low at 0.02%, and no public exploit code or active exploitation has been identified.

Technical ContextAI

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw classified under CWE-352, which occurs when a web application fails to properly validate that state-changing requests originate from the legitimate user. FormFacade, a WordPress plugin for form management, lacks adequate CSRF token validation or same-origin policy enforcement. An attacker can craft a malicious webpage or email containing a request to the FormFacade plugin's administrative functions. When a logged-in WordPress administrator or authorized user visits the attacker's site while authenticated to WordPress, the browser automatically includes session cookies, causing the plugin to execute the attacker's requested action without verification of request legitimacy.

Affected ProductsAI

FormFacade WordPress plugin versions 1.4.1 and earlier are affected. The plugin is available on the WordPress plugin repository. Affected users should consult the Patchstack database entry (referenced at patchstack.com/database/Wordpress/Plugin/formfacade) for confirmation of their installed version.

RemediationAI

Update FormFacade to the patched version released after 1.4.1 immediately. Consult the official Patchstack vulnerability database and the plugin's WordPress repository page for the specific patched version number and download link. As a temporary workaround pending patching, WordPress administrators should restrict plugin settings access to trusted users only and monitor user activity logs for suspicious form modifications or settings changes. Enable WordPress security headers (SameSite cookie attribute) at the server level if available, which may provide partial CSRF protection across all WordPress plugins.