CVE-2025-53312
BaseFortify
Publication date: 2025-06-27
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-53312 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress OnionBuzz plugin (versions up to 1.0.7). It allows an attacker to trick authenticated users, especially those with higher privileges, into performing unauthorized actions without their consent. This can lead to stored Cross-Site Scripting (XSS) attacks and compromise the integrity of the site. The vulnerability is classified under OWASP Top 10 category A1: Broken Access Control and has a CVSS score of 7.1, indicating a moderate severity level. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute unauthorized actions on your website through authenticated users, potentially leading to site compromise. It can result in stored XSS attacks, which may allow attackers to inject malicious scripts that affect site visitors or administrators. Since the plugin is abandoned and no official fix is available, the risk remains unless you replace the plugin or apply a virtual patch. The integrity and security of your website could be severely affected. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unauthorized or suspicious actions performed by authenticated users, as the vulnerability allows Cross-Site Request Forgery (CSRF) attacks leading to Stored XSS. Since no specific detection commands are provided, it is recommended to perform server-side malware scanning and monitor logs for unusual activity related to the OnionBuzz plugin. Plugin-based malware scanners may be unreliable, so professional incident response and thorough server-side analysis are advised. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include urgently replacing the OnionBuzz plugin with an alternative solution, as the plugin is abandoned and no official fix is available. Deactivating the plugin alone does not eliminate the risk unless a virtual patch (vPatch) is applied. Patchstack offers automated vPatching as a mitigation method. Additionally, proactive security measures such as server-side malware scanning and professional incident response if compromise is suspected are recommended. [1]