What is the CVSS score of CVE-2025-63060?

CVE-2025-63060 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Theme CVE-2025-63060

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-09 audit@patchstack.com

WordPress CSRF Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through < 4.25.0.

AnalysisAI

Cross-site request forgery in KALLYAS WordPress theme versions before 4.25.0 allows authenticated attackers to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. The vulnerability requires user interaction (UI:N indicates no additional user interaction beyond authentication) and affects only confidentiality with low impact. While CVSS scores 4.3 (medium severity), the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite public awareness.

Technical ContextAI

CSRF vulnerabilities (CWE-352) occur when a web application fails to validate that state-changing requests originate from the authenticated user rather than an attacker-controlled third party. In KALLYAS, a WordPress theme built on server-side rendering and form handling, an authenticated attacker can craft malicious links or pages that trigger unintended actions (such as theme modifications or content changes) when visited by legitimate administrators or users. The vulnerability requires the victim to already be authenticated to the WordPress site, limiting the attack surface to logged-in users. WordPress theme vulnerabilities of this type typically involve missing or improperly validated nonce fields in form submissions.

Affected ProductsAI

KALLYAS WordPress theme versions from an unspecified baseline through 4.24.9 are affected. The vulnerability is fixed in KALLYAS version 4.25.0 and later. Affected installations can be identified by the hogash KALLYAS theme CPE (wordpress:kallyas_theme). Users running KALLYAS below version 4.25.0 should assume vulnerability; no intermediate patch versions are documented.

RemediationAI

Update KALLYAS to version 4.25.0 or later immediately via the WordPress theme update mechanism (Appearance > Themes > Updates in the WordPress admin dashboard, or direct theme manager tools). Vendors should apply the patch referenced in the Patchstack security advisory (https://patchstack.com/database/Wordpress/Theme/kallyas/vulnerability/wordpress-kallyas-theme-4-2-cross-site-request-forgery-csrf-vulnerability). As an interim measure before patching, administrators should limit authenticated user permissions to the minimum required, monitor admin activity logs for unauthorized changes, and educate users about not clicking suspicious links while logged into WordPress.