What is the CVSS score of CVE-2025-64288?

CVE-2025-64288 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Premmerce Plugin CVE-2025-64288

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-29 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

CSRF inherently requires victim browser interaction (UI:R) and no attacker privileges; integrity-only impact as forged requests cannot read or exfiltrate response data.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:02 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through <= 1.3.19.

AnalysisAI

Cross-Site Request Forgery in the Premmerce WordPress plugin (versions through 1.3.19) enables network-based attackers to forge state-changing requests on behalf of authenticated WordPress users without their knowledge. The attack succeeds when a logged-in user visits an attacker-controlled page, causing the victim's browser to silently submit a crafted request to their WordPress site. No active exploitation is confirmed (absent from CISA KEV), no public exploit code has been identified, and EPSS sits at 0.01% (3rd percentile), collectively indicating very low real-world exploitation probability at this time.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) describes a class of vulnerabilities where an application processes requests without verifying that the authenticated user intentionally initiated them. In the WordPress ecosystem, plugins are expected to implement nonce-based CSRF protection via wp_nonce_field() on forms and check_admin_referer() or check_ajax_referer() on handlers; absence or improper use of these controls in Premmerce (a WooCommerce enhancement plugin) is the root cause. The CVSS vector AV:N/AC:L confirms the flaw is remotely reachable with no special complexity, and the UI:R component confirms the browser's same-origin cookie behavior is the exploitation mechanism. No CPE string was provided in the source data.

Affected ProductsAI

The Premmerce plugin for WordPress, versions from the initial release through and including 1.3.19, is confirmed affected per the Patchstack database entry (https://patchstack.com/database/Wordpress/Plugin/premmerce/vulnerability/wordpress-premmerce-plugin-1-3-19-cross-site-request-forgery-csrf-vulnerability). No CPE string was included in the source data. The lower version bound is listed as 'n/a' in the NVD entry, implying all prior releases may be vulnerable. No patch version has been independently confirmed from the available data.

RemediationAI

Site operators running the Premmerce plugin should update to any version released after 1.3.19 once a patched release is confirmed by the vendor - no specific fixed version is identified in the available source data. As an interim compensating control, administrators can deactivate the Premmerce plugin until a patched version is verified; this eliminates the attack surface with no data-loss risk since CSRF does not exfiltrate data. WordPress-level mitigations such as enforcing HTTPS everywhere and using a Web Application Firewall (WAF) with CSRF rules (e.g., Cloudflare or Wordfence) can reduce exploitation probability but should not be treated as a substitute for patching. Monitor the Patchstack advisory at the reference URL and the WordPress Plugin directory for an updated release.