CVE-2025-22552
Published: 07 January 2025
Summary
CVE-2025-22552 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22552 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Affiliate Disclosure Statement WordPress plugin by bnielsen. This issue affects all versions of the plugin up to and including 0.3. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and potential for scope change with limited impacts on confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this CSRF vulnerability over the network by tricking a victim user—typically an authenticated WordPress administrator—into interacting with a malicious webpage, such as by clicking a crafted link. This enables the attacker to forge requests to the plugin, potentially leading to stored cross-site scripting (XSS) as noted in related advisories, allowing execution of arbitrary scripts in the context of the victim's browser and affecting other users who view the injected content.
The Patchstack advisory provides further details on this CSRF-to-stored-XSS vulnerability in Affiliate Disclosure Statement version 0.3 and recommends mitigation steps, available at https://patchstack.com/database/Wordpress/Plugin/affiliate-disclosure-statement/vulnerability/wordpress-affiliate-disclosure-statement-plugin-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve. The CVE was published on 2025-01-07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2830
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly enables exploitation (T1190) leading to stored XSS for arbitrary JavaScript execution in victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms like CSRF tokens to directly prevent forged requests exploiting the vulnerability in the Affiliate Disclosure Statement plugin.
Validates information inputs such as CSRF tokens and plugin form data to block unauthorized state-changing requests and malicious XSS payloads.
Remediates the specific CSRF-to-stored-XSS flaw by identifying, reporting, and patching the vulnerable Affiliate Disclosure Statement plugin up to version 0.3.