What is the CVSS score of CVE-2025-64286?

CVE-2025-64286 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Rentals CVE-2025-64286

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-29 audit@patchstack.com

WordPress CSRF Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:N reflects attacker requires no credentials; UI:R is mandatory for CSRF; I:L only as no data exposure or availability impact is described.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:02 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through <= 3.13.1.

AnalysisAI

Cross-Site Request Forgery in the WP Rentals WordPress theme (WpEstate) through version 3.13.1 allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking authenticated site users into visiting a crafted page. The CVSS vector (PR:N/UI:R) confirms the attacker needs no credentials themselves but must socially engineer a logged-in victim. With an EPSS of 0.01% (3rd percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is low at this time.

Technical ContextAI

WP Rentals is a commercial WordPress theme by WpEstate designed for property rental listings. CSRF (CWE-352) arises when a web application fails to validate that state-changing HTTP requests originated from the application itself rather than a third-party site. WordPress themes are expected to protect sensitive actions using nonces (cryptographic tokens tied to the logged-in user session), and this vulnerability indicates one or more such actions lack that protection. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U confirms the attack is network-delivered, requires no authentication from the attacker side, imposes low complexity, and is limited to integrity impact within the vulnerable system scope only.

Affected ProductsAI

WP Rentals WordPress theme by WpEstate is affected from an unspecified baseline version through and including version 3.13.1. No CPE string was provided in the source data. Full vulnerability details are documented in the Patchstack database at https://patchstack.com/database/Wordpress/Theme/wprentals/vulnerability/wordpress-wp-rentals-theme-3-13-1-cross-site-request-forgery-csrf-vulnerability. No other products or vendor components are identified as affected.

RemediationAI

The primary remediation is to update the WP Rentals theme to a version beyond 3.13.1. The exact patched release version is not confirmed from the available input data - site operators should verify the latest available version via the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/wprentals/vulnerability/wordpress-wp-rentals-theme-3-13-1-cross-site-request-forgery-csrf-vulnerability or the WpEstate official channel before upgrading. As a compensating control where immediate patching is not feasible, consider restricting access to administrative WordPress functionality to trusted IP ranges via server-level access controls (e.g., nginx/Apache location blocks), which reduces the attacker's ability to deliver the forged request to a valid authenticated session. Note that IP restriction may impact legitimate remote administrators.