EUVD-2025-17271Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link
-
DeliveryDeliver via email or web
-
ExploitVictim clicks while authenticated
-
ExecutionForged request sent
-
PersistState change in plugin settings
-
ImpactIntegrity impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must trick an authenticated WordPress administrator into clicking a malicious link or visiting a crafted page while logged into the WordPress admin panel. No special configuration is required; the vulnerability exists in default installations of the plugin up to version 5.3.58. The attack is unauthenticated from the attacker's perspective but requires the victim to have admin privileges. |
| Impact | The CVSS score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating a network-attackable, low-complexity vulnerability that requires user interaction and results in low integrity impact with no confidentiality or availability impact. The EPSS score is 0.03% (percentile 7%), suggesting a very low probability of exploitation in the wild. There is no mention of CISA KEV or public exploit code. The SSVC decision would likely be 'Medium' due to low exploitation status and automatable? (likely not automatable as it requires user interaction). Overall, this is a low-priority issue for most environments. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or webpage that, when clicked by an authenticated WordPress administrator, triggers a forged request to change a form's calculation logic or delete form data. The attack requires the victim to be logged in and interact with the malicious content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.
RemediationAI
Update the Calculated Fields Form plugin to version 5.3.59 or later, which contains the fix. The vendor advisory is available at the Patchstack link. As a workaround, administrators can implement CSRF tokens or use WordPress nonces, but the best practice is to apply the patch. No other workarounds are documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Cross-Site Request Forgery (CSRF) issue (CWE-352) in the Calculated Fields Form plugin for WordPress. CSRF attacks exploit the trust a web application has in an authenticated user's browser, allowing an attacker to forge requests that perform state-changing operations on behalf of the victim. The affected product is a WordPress plugin used to create dynamic forms with calculations. The CPE string cpe:2.3:a:codepeople:calculated_fields_form:*:*:*:*:*:wordpress:*:* indicates all versions up to 5.3.58 are affected.
Know when Calculated Fields Form gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Matches provided vector; requires user interaction (UI:R) and no privileges (PR:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n/a through 5.3.58.
Executive ViewAI
CVE-2025-49291 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Calculated Fields Form
View allThe Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href para
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calcula
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULA
Medium severity vulnerability in WordPress plugin. The Calculated Fields Form plugin for WordPress is vulnerable to Stor
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including,
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.
GitHub PoC
Exploit-DB