CVE-2025-31039
BaseFortify
Publication date: 2025-06-09
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-31039 is an XML External Entity (XXE) vulnerability in the WordPress Category Icon plugin versions up to 1.0.2. It allows an attacker with author-level privileges to inject arbitrary XML, which can lead to sensitive information disclosure, denial of service (DoS), and server-side request forgery (SSRF). This vulnerability is classified as a high-severity injection flaw. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to access sensitive information from your server, cause denial of service conditions, or perform server-side request forgery attacks. These impacts can compromise the confidentiality, integrity, and availability of your system and data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for exploitation attempts that include XML payloads with external entity references targeting the Category Icon plugin. Since exploitation requires author-level privileges and involves XML injection, inspecting web server logs for suspicious XML POST requests or unusual server-side requests (SSRF) may help. Additionally, professional incident response and server-side malware scanning are recommended. No specific commands are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying Patchstack's virtual patching (vPatching) solution to protect affected sites without requiring an official plugin update. Since no official fix or updated plugin version is currently available, virtual patching is the recommended approach. It is also advised to perform professional incident response and server-side malware scanning if compromise is suspected, and to avoid relying solely on plugin-based malware scanners. [1]