Premmerce Plugin CVE-2025-64288

Exploitation requires that a victim user hold an active, authenticated session on the target WordPress site at the moment they visit the attacker's page - an administrator or any user with privileges to invoke the affected Premmerce functionality is the realistic target. The victim must be socially engineered into visiting an attacker-controlled URL or page embedding the forged request (UI:R). The target site must be running Premmerce plugin version 1.3.19 or earlier. No special server configuration or non-default WordPress setting is required beyond having the plugin installed and activated. Exploitation is limited to the integrity impact of actions the authenticated victim is permitted to take; data exfiltration is not possible via CSRF alone.

The CVSS base score of 4.3 (Medium) reflects a restrained integrity-only impact (I:L) with no confidentiality or availability loss, consistent with typical CSRF outcomes such as unauthorized settings changes or content modifications. EPSS at 0.01% places this in the 3rd percentile globally, indicating the security community currently observes virtually no exploitation activity. The vulnerability is absent from the CISA KEV catalog and no public POC or exploit module has been identified. Taken together, these signals suggest this is a real but low-priority finding - the attack requires social engineering to lure an authenticated administrator, limits damage to whatever actions that user could take, and operates in a plugin with limited deployment footprint. The CVSS AC:L metric is technically accurate but somewhat misleading in practice, as successful exploitation still depends on the attacker's ability to deliver a convincing lure to a logged-in admin.

An attacker hosts a webpage containing a hidden HTML form or JavaScript fetch that targets a Premmerce action endpoint on a victim's WordPress site. The attacker sends the link to a WordPress administrator via phishing email or embeds it in a forum post; when the admin loads the page while their WordPress session is active, the browser automatically submits the forged request with the admin's session cookies, performing an unauthorized action within Premmerce's scope. No public exploit code has been identified at time of analysis.