EUVD-2025-17177
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
Lifecycle Timeline
3Description
Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin allows SQL Injection. This issue affects Epicwin Plugin: from n/a through 1.5.
Analysis
A Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin versions up to 1.5 allows unauthenticated attackers to perform unauthorized actions via crafted requests. While the CVE description anomalously mentions SQL Injection alongside CSRF, the CVSS vector (CWE-352: CSRF) and vector string indicate the primary threat is CSRF with consequential impacts on confidentiality (High) and availability (Low). The vulnerability requires user interaction (UI:R) and affects confidentiality significantly, making it a material risk for WordPress installations using this plugin, particularly if no active mitigation or patch is available.
Technical Context
This vulnerability affects Webaholicson Epicwin Plugin (WordPress plugin ecosystem, CPE likely wp:epicwin or similar), which processes user requests without sufficient CSRF token validation. CWE-352 (Cross-Site Request Forgery) describes the root cause: the application fails to implement or enforce anti-CSRF mechanisms (such as nonce verification in WordPress). The anomalous mention of SQL Injection in the description alongside CSRF suggests either: (1) a chained vulnerability where CSRF enables SQL Injection via unvalidated parameters, or (2) descriptive inaccuracy. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-based exploitation with low complexity, no privilege requirement, but user interaction needed—typical of CSRF. The scope change (S:C) indicates the impact extends beyond the vulnerable component, consistent with CSRF affecting other users or the application's broader state.
Affected Products
Epicwin Plugin (1.5 and earlier (versions n/a through 1.5))
Remediation
patch: Update Epicwin Plugin to version > 1.5 if available from Webaholicson. Check official WordPress plugin repository (wordpress.org/plugins/epicwin) for latest release.; priority: Immediate workaround: If patched version unavailable: (1) Disable Epicwin Plugin temporarily via wp-admin or remove from /wp-content/plugins/. (2) Review plugin code for CSRF-protected endpoints; implement nonce verification using wp_verify_nonce() if code audit is possible. (3) Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns targeting the plugin.; priority: High detection: Monitor web logs for repeated POST/GET requests to Epicwin plugin endpoints without corresponding user sessions or referrer headers. Use WordPress security plugins (Wordfence, Sucuri) to detect CSRF-like patterns.; priority: Ongoing
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today