CVE-2025-12358
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shopengine | shopengine | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress, affecting all versions up to and including 4.8.5. It occurs because the plugin lacks proper nonce validation on the "post_add_to_list" function and has an incorrect permissions callback in the "Api/init" function. This allows unauthenticated attackers to trick a site's user into performing actions, such as adding or removing products from their wishlist, via a forged request.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to manipulate your wishlist without your consent. Specifically, an attacker can add or remove products from your wishlist by tricking you into clicking a malicious link. This could lead to unwanted changes in your user experience or potentially be used as part of a larger attack or manipulation strategy.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the ShopEngine Elementor WooCommerce Builder Addon plugin to a version later than 4.8.5, as all versions up to and including 4.8.5 are vulnerable. Since the provided changeset for version 4.8.6 does not explicitly mention a fix for this vulnerability, verify with the plugin vendor or official changelog that the update addresses the issue. Additionally, consider implementing standard WordPress security practices such as limiting user permissions and educating users to avoid clicking on suspicious links to reduce the risk of Cross-Site Request Forgery attacks. [1]