CVE-2025-52772
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52772 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Virtual Moderator plugin (versions up to 1.4). It allows an attacker to trick authenticated users with higher privileges into executing unwanted actions on the site without their consent. This can lead to Cross-Site Scripting (XSS) issues and potentially compromise the integrity of the site. Exploitation does not require authentication, making it accessible to unauthenticated attackers. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform unauthorized actions on your WordPress site through the Virtual Moderator plugin. Since it can be exploited by unauthenticated attackers tricking privileged users, it may lead to site integrity compromise, including injection attacks and Cross-Site Scripting (XSS). This could result in data manipulation, defacement, or other malicious activities affecting your website's security and functionality. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability cannot reliably be done using plugin-based malware scanners as they may be unreliable. There are no specific commands provided for detection. Users are advised to seek professional incident response services if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is available, immediate mitigation can be done by applying virtual patching (vPatching) offered by Patchstack, which provides automatic protection. Additionally, monitoring for suspicious activity and seeking professional incident response services if compromise is suspected are recommended. [1]