CVE-2025-49269
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WordPress Market Exporter plugin up to version 2.0.22. It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions on the site without their consent. Essentially, the attacker can exploit the trust a site has in a user's browser to execute actions that compromise site integrity. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to perform unauthorized actions on your site through authenticated users, potentially compromising the integrity of your site. Although it has a low severity rating and is unlikely to be widely exploited, it still poses a risk of unauthorized changes or actions being executed without your knowledge. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this CSRF vulnerability involves checking the version of the Market Exporter WordPress plugin installed on your system. If the version is 2.0.22 or earlier, it is vulnerable. There are no specific network commands provided to detect exploitation attempts. You can verify the plugin version via WordPress admin dashboard or by running commands to check plugin versions, such as: `wp plugin list --format=json` using WP-CLI, which will show installed plugin versions. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Market Exporter plugin to version 2.0.23 or later, where the vulnerability is fixed. Alternatively, Patchstack offers virtual patching (vPatching) to auto-mitigate the vulnerability before applying the official update. Since the vulnerability requires no authentication to exploit, updating or applying virtual patching is strongly recommended to prevent potential exploitation. [1]