CVE-2025-59572
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | workscout-core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the WordPress WorkScout-Core Plugin versions prior to 1.7.06. It allows an attacker to trick authenticated users with higher privileges into performing unauthorized actions on the site without their consent. This can lead to compromising the site's security by exploiting broken access control. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute unauthorized actions while you are authenticated, potentially leading to a full compromise of your site. This includes unauthorized changes, data manipulation, or other harmful actions that affect confidentiality, integrity, and availability of your site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking the version of the WorkScout-Core plugin installed on your WordPress site. Versions prior to 1.7.06 are vulnerable. You can detect the plugin version via WordPress admin dashboard or by running commands to check the plugin files. For example, using WP-CLI: `wp plugin list` will show installed plugins and their versions. Additionally, server-side malware scanning is recommended if compromise is suspected, as plugin-based scanners may be unreliable due to tampering. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the WorkScout-Core plugin to version 1.7.06 or later, where the vulnerability is fixed. Patchstack also offers an auto-update feature for vulnerable plugins to facilitate quick remediation. If you suspect compromise, contact your hosting provider for server-side malware scanning. No virtual patch is necessary due to the low priority rating of the patch, but rapid updating is strongly advised. [1]