Stockie Extra CVE-2025-64226
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF with no attacker authentication needed but mandatory victim interaction; only limited integrity impact with no confidentiality or availability dimension.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: from n/a through <= 1.2.11.
AnalysisAI
Cross-site request forgery in the Stockie Extra WordPress plugin (versions through 1.2.11) enables unauthenticated remote attackers to perform unauthorized state-changing actions by tricking a logged-in WordPress user into visiting attacker-controlled content. The CVSS vector (PR:N/UI:R/I:L) confirms exploitation requires no attacker authentication but mandates victim interaction, and impact is bounded to limited integrity modification - not full site compromise. No public exploit identified at time of analysis; EPSS of 0.01% at the 3rd percentile indicates negligible exploitation interest in the wild.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) describes a vulnerability class where a web application fails to distinguish legitimate user-initiated requests from forged ones submitted by a third-party page. In the WordPress ecosystem, proper CSRF protection relies on nonce verification - Stockie Extra (a companion plugin to the Stockie commercial theme by Colabrio) appears to omit or improperly validate nonces on one or more state-changing endpoints. The CVSS AV:N/AC:L/PR:N/UI:R vector confirms the attack is fully network-deliverable, requires no special conditions or attacker authentication, but necessitates that a legitimately authenticated WordPress user visit attacker-controlled content while their session is active. Scope is unchanged (S:U), meaning exploitation does not break out of the plugin's security context.
Affected ProductsAI
The Stockie Extra WordPress plugin by Colabrio is affected in all versions from the initial release through and including version 1.2.11. No CPE string was provided in the available intelligence data; the authoritative Patchstack advisory covering this range is available at https://patchstack.com/database/Wordpress/Plugin/stockie-extra/vulnerability/wordpress-stockie-extra-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability. A specific fixed version is not independently confirmed by available data.
RemediationAI
Check the WordPress Plugin Directory or the Colabrio Stockie Extra plugin page for a release newer than version 1.2.11 and upgrade immediately if one exists; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/stockie-extra/vulnerability/wordpress-stockie-extra-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability should be consulted for confirmed fix version details, which were not available in the current intelligence snapshot. If no patched version is yet released, consider temporarily deactivating the plugin on publicly exposed sites as a compensating control - note this will disable Stockie Extra functionality. Regardless of patch status, WordPress administrators should practice session hygiene by logging out of wp-admin when not actively managing the site, as this directly eliminates the victim-session prerequisite for CSRF exploitation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today