Popup Box EUVD-2025-209259

This vulnerability presents a disconnect between its assigned CVSS severity (5.4, moderate) and its extremely low EPSS exploitation probability (0.02%, 6th percentile). The CVSS vector (PR:L/UI:R) correctly identifies that exploitation requires a logged-in WordPress admin with user interaction (visiting a malicious link), which limits attack surface. The presence of publicly available exploit code elevates technical readiness, but the EPSS metric-which factors real-world exploitation patterns-suggests active exploitation is rare. SSVC analysis would classify this as low-priority: while the technical impact is moderate (cross-site execution context), automatable exploitation is constrained by the PR:L requirement and UI:R interaction component. The threat model requires either compromising an admin's browsing session or sophisticated phishing, making this a lower-priority remediation compared to unauthenticated RCE or SQL injection vulnerabilities. Organizations should prioritize this below critical/high-CVSS issues but address it as part of routine plugin updates.

An attacker crafts a malicious webpage containing a hidden form that targets the WordPress admin's popup creation endpoint, prefilled with JavaScript that logs admin credentials or redirects to a credential-harvesting page. The attacker emails a WordPress administrator (e.g., a site owner) a link to this page disguised as a legitimate resource. When the logged-in admin clicks the link and the page loads, the hidden form auto-submits due to the missing nonce validation, silently creating a popup with the malicious script. The script then executes in the admin panel, potentially stealing session tokens or modifying site content. Publicly available proof-of-concept code exists (per WPScan), but successful exploitation remains contingent on the admin being logged into WordPress at the moment of page visit, explaining the very low EPSS exploitation rate.