CVE-2025-23972
BaseFortify
Publication date: 2025-07-04
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Contact Form 7 reCAPTCHA WordPress plugin (versions up to 1.2.0). It allows an attacker to trick authenticated users, especially those with higher privileges, into performing unintended actions on the site without their consent. This can compromise site security by exploiting broken access control mechanisms. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized actions being performed on your website by attackers exploiting authenticated users. This can compromise your site's security, potentially allowing attackers to manipulate site functions or data. Since the plugin is abandoned and unpatched, the risk remains unless mitigated by removing the plugin or applying a virtual patch. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system detection methods provided for this vulnerability. Detection would typically involve checking if the Contact Form 7 reCAPTCHA plugin version is up to and including 1.2.0 installed on your WordPress site, as these versions are vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the Contact Form 7 reCAPTCHA plugin since it is abandoned and has no official patch. Applying a virtual patch (vPatch) from Patchstack can provide automatic protection. Deactivating the plugin alone does not eliminate the risk. Consider using alternative plugins and seek professional incident response if compromise is suspected. [1]