CVE-2025-58860
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kaizencoders | enable_latex | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WordPress Enable Latex Plugin up to version 1.2.16. It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions on the site without their consent. This can lead to stored Cross-Site Scripting (XSS) attacks, compromising site security. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute unauthorized actions on your site by exploiting authenticated users, potentially leading to compromised site security. This includes the risk of stored XSS attacks, which can result in data theft, session hijacking, or further exploitation of the site. Since the plugin is abandoned and no official fix is available, the risk remains unless mitigated by virtual patches or plugin removal. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific commands provided to detect this vulnerability on your network or system. The vulnerability involves Cross-Site Request Forgery (CSRF) in the Enable Latex WordPress plugin, which is a logic flaw rather than a detectable network signature. Users are advised not to rely solely on plugin-based malware scanners for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing and replacing the Enable Latex plugin with an alternative plugin, as no official fix or updated version is available. Applying a virtual patch (vPatch) from Patchstack can provide immediate protection. Deactivating the plugin alone does not eliminate the risk. Consider professional incident response services if compromise is suspected. [1]