Premmerce Product Search CVE-2025-64290
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Standard CSRF pattern: attacker needs no privileges (PR:N), victim interaction is required (UI:R), and impact is limited to integrity with no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
AnalysisAI
Cross-Site Request Forgery in the Premmerce Product Search for WooCommerce WordPress plugin (versions ≤ 2.2.4) enables a remote attacker to forge state-changing requests on behalf of an authenticated WordPress user. The attack requires no privileges from the attacker but depends on social engineering an authenticated administrator or shop manager into visiting a malicious page while logged in. No public exploit has been identified at time of analysis, and EPSS at 0.01% (3rd percentile) reflects very low real-world exploitation probability.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) arises when a web application processes state-changing requests without validating that they originate from a trusted, authenticated session rather than a forged cross-origin submission. In WordPress plugins, this typically manifests as missing or bypassable nonce verification on AJAX handlers or admin-action endpoints. The Premmerce Product Search plugin extends WooCommerce - WordPress's dominant e-commerce layer - with product search capabilities. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms the attack is network-deliverable, requires no special conditions or attacker privileges, but mandates victim interaction. No CPE string was supplied in the source data; the affected product is identified solely by plugin slug 'premmerce-search' as documented by Patchstack.
Affected ProductsAI
Premmerce Product Search for WooCommerce WordPress plugin, all versions from an unspecified baseline through and including version 2.2.4, as documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve. No CPE string was provided in the source intelligence. The lower bound of the affected version range is listed as 'n/a' in the NVD entry, indicating all known prior versions are considered vulnerable.
RemediationAI
No patched version number is available in the provided source data - the exact fix version has not been independently confirmed. Site operators should monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve and the WordPress Plugin Repository for a release above 2.2.4 that addresses this issue, then apply it promptly. As a compensating control, administrators should avoid clicking unsolicited or unfamiliar links while authenticated to the WordPress admin dashboard. WAF-based CSRF protection via a security plugin such as Wordfence or NinjaFirewall can add nonce enforcement at the perimeter, though this introduces compatibility maintenance overhead. If the plugin is non-essential, temporarily disabling it until a fix is confirmed is a low-trade-off option.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today