CVE-2025-58806
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bugsnag | wordpress_error_monitoring | 1.6.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WordPress Error Monitoring by Bugsnag plugin (versions up to 1.6.3). It allows an attacker to trick authenticated users with higher privileges into executing unwanted actions on the site, which can lead to Stored Cross-Site Scripting (XSS) attacks and compromise site security. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to perform unauthorized actions on your WordPress site by exploiting authenticated users, potentially leading to stored XSS attacks. This can compromise the security of your site, including data integrity and availability. Since the plugin is abandoned and no official fix exists, the risk remains unless mitigated by virtual patches or removing the plugin. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying the presence of the vulnerable WordPress Error Monitoring by Bugsnag plugin version 1.6.3 or earlier on your system. Since the plugin is abandoned and no official patches exist, plugin-based malware scanners may be unreliable. There are no specific commands provided to detect this vulnerability in the resources. It is recommended to check the installed plugin versions in your WordPress installation to confirm if the vulnerable version is present. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the vulnerable WordPress Error Monitoring by Bugsnag plugin, as no official fix or updated version is available. Applying a virtual patch (vPatch) offered by Patchstack can provide immediate protection without an official patch. Deactivating the plugin alone does not eliminate the threat. Users are also advised to seek professional incident response if their sites have been compromised. [1]