CVE-2025-67626
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| angel_costa | wp_seo_search | to 1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67626 is a Cross Site Request Forgery (CSRF) vulnerability in the WordPress WP SEO Search Plugin versions up to and including 1.1. It allows an attacker to trick privileged users into performing unwanted actions while authenticated by having them click a malicious link, visit a crafted page, or submit a form. Exploitation requires user interaction and a privileged user session. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized actions being executed on your WordPress site by attackers exploiting privileged users. Although the severity is low (CVSS 4.3) and exploitation requires user interaction, it could result in unwanted changes or actions performed without the user's consent, potentially affecting site integrity or configuration. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network indicators provided for this CSRF vulnerability in the WP SEO Search plugin. Detection typically involves reviewing if the vulnerable plugin version (up to 1.1) is installed and checking for suspicious user interactions that could trigger CSRF attacks. Since exploitation requires user interaction and privileged user authentication, monitoring for unusual user activity or unexpected changes initiated by authenticated users may help. However, no explicit commands or automated detection methods are detailed. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include limiting access to privileged user accounts, educating users to avoid clicking untrusted links or submitting forms from untrusted sources, and monitoring user activity for suspicious actions. Since no official fix or patched version is currently available, consider disabling or removing the WP SEO Search plugin if feasible until a patch is released. Applying general CSRF protections such as using anti-CSRF tokens in forms and ensuring proper user session management can also help reduce risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this Cross-Site Request Forgery (CSRF) vulnerability in WP SEO Search affects compliance with common standards and regulations such as GDPR or HIPAA.