CVE-2025-58833
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| invelity | mygls_connect | 1.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58833 is a Cross-Site Request Forgery (CSRF) vulnerability in the Invelity MyGLS connect WordPress plugin versions up to 1.1.1. It allows a malicious actor to trick authenticated users with higher privileges into executing unauthorized actions on the website, potentially compromising its security. The vulnerability involves object injection and requires no authentication to exploit. There is currently no official patch, but virtual patching is available as a mitigation. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform unauthorized actions on your website by exploiting authenticated users, potentially leading to full compromise of the website's security. Because it has a high CVSS score of 8.8, the impact includes high confidentiality, integrity, and availability risks. However, the report notes the likelihood of exploitation as low and classifies the patch priority as low. Without mitigation, your site could be vulnerable to malicious changes or data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. However, professional incident response services and server-side malware scanning are recommended if a website is suspected to be compromised. Plugin-based malware scanners are not recommended due to their susceptibility to tampering. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch or fixed version is available, the recommended immediate mitigation is to apply Patchstack's virtual patching (vPatching) technology, which auto-mitigates the vulnerability without requiring an official update. Additionally, rapid protection through virtual patching and professional incident response services are advised. [1]