CVE-2025-58611
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tickera | tickera | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Request Forgery (CSRF) in the WordPress Tickera Plugin up to version 3.5.5.6. It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions on the site without their consent, potentially compromising site integrity. The vulnerability requires no authentication to exploit and is classified under OWASP Top 10 A1: Broken Access Control. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute unwanted actions on your site through authenticated users with higher privileges. This can lead to compromised site integrity, unauthorized changes, or other malicious activities performed without the user's knowledge. Although the severity is low (CVSS 4.3), it still poses a risk if not patched. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this CSRF vulnerability involves checking the version of the Tickera WordPress plugin installed on your system. You can detect vulnerable versions by verifying the plugin version is 3.5.5.6 or earlier. For example, you can use WordPress CLI commands such as `wp plugin list` to list installed plugins and their versions. There are no specific network commands or signatures mentioned for detecting exploitation attempts of this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Tickera WordPress plugin to version 3.5.5.8 or later, where the vulnerability is fixed. Patchstack also offers automatic updates for vulnerable plugins, which can be enabled to ensure timely patching. Since the vulnerability is low severity and requires no authentication to exploit, timely patching is the recommended action to prevent opportunistic automated attacks. [1]