CVE-2025-58847
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wn | flipbox_pro | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58847 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress WN Flipbox Pro plugin (versions up to 2.1). It allows an attacker to trick authenticated users with higher privileges into executing unwanted actions on the site, potentially compromising site security. This vulnerability also enables reflected Cross-Site Scripting (XSS) attacks. The plugin is abandoned with no official patches available. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized actions being performed on your website by attackers exploiting authenticated users, potentially resulting in compromised site security. It can cause data integrity issues, unauthorized changes, and possibly allow attackers to execute malicious scripts via reflected XSS. Since the plugin is abandoned and unpatched, the risk remains unless mitigated by virtual patching or removing the plugin. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. Plugin-based malware scanners may be unreliable for detecting this issue. It is recommended to monitor for unusual actions performed by authenticated users that could indicate exploitation of the CSRF vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the WN Flipbox Pro plugin with an alternative, as there is no official patch and the plugin is abandoned. Applying a virtual patch (vPatch) from Patchstack can provide rapid protection. Deactivating the plugin alone does not eliminate the risk. Seeking professional incident response services is advised if compromise is suspected. [1]