What is the CVSS score of EUVD-2025-17177?

EUVD-2025-17177 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17177?

A critical vulnerability in the Epicwin Plugin (versions up to 1.5) combines CSRF and SQL injection attacks, allowing unauthenticated attackers to manipulate or exfiltrate sensitive database…

How to fix or mitigate EUVD-2025-17177?

Within 24 hours: Audit all systems running Epicwin Plugin versions 1.5 and below; isolate affected instances if business-critical. Within 7 days: Implement WAF rules to block SQL injection patterns and enforce CSRF token validation; consider disabling the plugin if non-essential. Within 30 days: Evaluate plugin replacement options, monitor vendor for patch availability, and conduct security assessment of potentially compromised data.

Wordpress Plugin EUVD-2025-17177

| CVE-2025-28986 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress SQLi CSRF Wordpress Plugin

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17177

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 8.2

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin allows SQL Injection. This issue affects Epicwin Plugin: from n/a through 1.5.

AnalysisAI

A Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin versions up to 1.5 allows unauthenticated attackers to perform unauthorized actions via crafted requests. While the CVE description anomalously mentions SQL Injection alongside CSRF, the CVSS vector (CWE-352: CSRF) and vector string indicate the primary threat is CSRF with consequential impacts on confidentiality (High) and availability (Low). The vulnerability requires user interaction (UI:R) and affects confidentiality significantly, making it a material risk for WordPress installations using this plugin, particularly if no active mitigation or patch is available.

Technical ContextAI

This vulnerability affects Webaholicson Epicwin Plugin (WordPress plugin ecosystem, CPE likely wp:epicwin or similar), which processes user requests without sufficient CSRF token validation. CWE-352 (Cross-Site Request Forgery) describes the root cause: the application fails to implement or enforce anti-CSRF mechanisms (such as nonce verification in WordPress). The anomalous mention of SQL Injection in the description alongside CSRF suggests either: (1) a chained vulnerability where CSRF enables SQL Injection via unvalidated parameters, or (2) descriptive inaccuracy. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-based exploitation with low complexity, no privilege requirement, but user interaction needed—typical of CSRF. The scope change (S:C) indicates the impact extends beyond the vulnerable component, consistent with CSRF affecting other users or the application's broader state.

RemediationAI

patch: Update Epicwin Plugin to version > 1.5 if available from Webaholicson. Check official WordPress plugin repository (wordpress.org/plugins/epicwin) for latest release.; priority: Immediate workaround: If patched version unavailable: (1) Disable Epicwin Plugin temporarily via wp-admin or remove from /wp-content/plugins/. (2) Review plugin code for CSRF-protected endpoints; implement nonce verification using wp_verify_nonce() if code audit is possible. (3) Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns targeting the plugin.; priority: High detection: Monitor web logs for repeated POST/GET requests to Epicwin plugin endpoints without corresponding user sessions or referrer headers. Use WordPress security plugins (Wordfence, Sucuri) to detect CSRF-like patterns.; priority: Ongoing