CVE-2025-48328
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WordPress plugin Real Time Validation for Gravity Forms (up to version 1.7.0). It allows an attacker to trick authenticated users with higher privileges into performing unauthorized actions, such as changing plugin settings, without their consent. The vulnerability falls under the OWASP Top 10 category A1: Broken Access Control and has a low severity score of 4.3. There is no official patch available as the plugin appears abandoned. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform unauthorized changes to your plugin settings if a privileged user is tricked into executing malicious requests. This could lead to misconfiguration or compromise of your WordPress site functionality. Since the plugin is abandoned and unpatched, the risk remains unless you remove or replace the plugin or apply a virtual patch. [1]
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to remove and replace the vulnerable Real Time Validation for Gravity Forms plugin with an alternative, as simply deactivating it does not eliminate the security risk. Since no official patch or fix is available due to the plugin being abandoned, applying a virtual patch (vPatch) from Patchstack can protect against this vulnerability. Users should also consider seeking professional incident response if compromise is suspected. [1]