What is the CVSS score of CVE-2025-64368?

CVE-2025-64368 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Bard CVE-2025-64368

Q: Which versions of Bard are affected by CVE-2025-64368?

Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker.

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-31 audit@patchstack.com

WordPress CSRF Bard Wordpress Theme Qodeinteractive

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Requires user interaction (UI:R); low integrity and availability impact, no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:18 vuln.today

CVE Published

Oct 31, 2025 - 12:15 cve.org

MEDIUM 5.4

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 1.6.

AnalysisAI

Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker. The vulnerability affects Bard versions up to and including 1.6. The flaw has a medium severity score, very low exploitation probability, and no reports of active exploitation or publicly available exploit code.

Technical ContextAI

The vulnerability resides in the Bard WordPress theme (CPE cpe:2.3:a:qodeinteractive:bard:*:*:*:*:*:wordpress:*:*) and is classified as CWE-352 (Cross-Site Request Forgery). CSRF flaws occur when a web application accepts state-changing requests without a unique token to verify the request's origin, allowing an attacker to craft a malicious link or form that, when visited by an authenticated user, forces their browser to send a forged request to the vulnerable application. In the context of a WordPress theme, this could involve settings, customization, or data alteration endpoints that lack proper nonce validation.

RemediationAI

Update the Bard theme to a version later than 1.6 immediately via the WordPress dashboard or by manually replacing the theme files. The exact fixed version is not specified in the provided data, but applying the latest available release from Qode Interactive is the primary mitigation. As a temporary workaround, disable the Bard theme and switch to a default WordPress theme until the patch is applied. Note that this will change the site’s appearance. No other effective compensating controls exist for CSRF in themes without code modifications. The Patchstack advisory should be consulted for the specific fixed version if released.