CVE-2025-58800
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wp_email_template | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the WP Email Template WordPress plugin (versions up to 2.8.3). It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions on the site without their consent, potentially compromising site integrity. The attacker does not need to be authenticated to initiate the attack. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute unauthorized actions on your WordPress site through the WP Email Template plugin. This can compromise the integrity of your site by making changes or performing actions that the attacker chooses, potentially leading to security issues or misuse of your site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this CSRF vulnerability involves monitoring for unusual or unauthorized actions performed by authenticated users, as the attack tricks higher privileged users into executing unwanted actions. Since no specific detection commands are provided, it is recommended to perform professional incident response and server-side malware scanning to identify potential compromise. Reliance on plugin-based malware scanners is discouraged. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying Patchstack's virtual patching (vPatch) which auto-mitigates the vulnerability without requiring an official patch and without performance loss. Users should monitor their systems closely, apply mitigations promptly, and if compromise is suspected, conduct professional incident response and server-side malware scanning. [1]