CVE-2025-22784
Published: 15 January 2025
Summary
CVE-2025-22784 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring identification, reporting, and timely patching of the CSRF-to-arbitrary-file-deletion flaw in the Background Control WordPress plugin.
Prevents CSRF exploitation by enforcing session authenticity mechanisms such as unique session identifiers and anti-replay protections.
Blocks path traversal payloads in CSRF requests by validating all information inputs to prevent arbitrary file deletion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF with path traversal in public-facing WordPress plugin enables remote unauthenticated arbitrary file deletion causing availability impact, directly mapping to exploitation of public-facing apps (T1190) and data destruction (T1485).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.
Deeper analysisAI
CVE-2025-22784 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Background Control WordPress plugin developed by swedish boy. The flaw enables path traversal and affects all versions of the plugin up to and including 1.0.5.
Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required, as reflected in its CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Exploitation allows attackers to perform arbitrary file deletion on the target system, resulting in high-impact disruption to availability.
The Patchstack advisory documents this as a CSRF-to-arbitrary-file-deletion vulnerability specifically in Background Control plugin version 1.0.5 and provides details on the issue.
Details
- CWE(s)