CVE-2025-7841
BaseFortify
Publication date: 2025-08-23
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sertifier | sertifier_certificate_and_badge_maker | 1.19 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin, affecting all versions up to and including 1.19. It occurs because of missing or incorrect nonce validation on the 'sertifier_settings' page, allowing an attacker to trick a site administrator into performing an unwanted action, such as updating the plugin's API key via a forged request.
How can this vulnerability impact me? :
An unauthenticated attacker could exploit this vulnerability to update the plugin's API key by tricking a site administrator into clicking a malicious link. This could lead to unauthorized changes in the plugin's configuration, potentially compromising the integrity or functionality of the plugin on your WordPress site.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately disable or uninstall the Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin if it is installed, especially if it is version 1.19 or earlier. Since the plugin has been temporarily closed and is unavailable for download pending a full review, avoid reinstalling or updating it until a secure version is released. Additionally, ensure that site administrators are aware of the risk of clicking on untrusted links that could exploit this Cross-Site Request Forgery vulnerability. [1]