CVE-2025-23445

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0010 28.0th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23445 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-23445 is a Cross-Site Request Forgery (CSRF) vulnerability, corresponding to CWE-352, in the Easy Tynt WordPress plugin (easy-tynt) developed by scottswezey. The issue affects all versions from n/a through 0.2.5.1. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, and changed scope.

Attackers without privileges can exploit this over the network by tricking authenticated users into interacting with maliciously crafted web pages or links that submit forged requests to the vulnerable plugin. Successful exploitation enables unauthorized actions on behalf of the victim, potentially leading to low-level impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/easy-tynt/vulnerability/wordpress-easy-tynt-plugin-0-2-5-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability, framing it as a CSRF issue enabling stored cross-site scripting (XSS). Security practitioners should consult this for patch availability and mitigation guidance, such as updating to a fixed version if released or implementing CSRF protections.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3186

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a through <= 0.2.5.1.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

CSRF vulnerability in public-facing WordPress plugin exploited over network via malicious links/pages to perform unauthorized actions as authenticated user, directly mapping to T1190 Exploit Public-Facing Application and T1204.001 Malicious Link; also enables stored XSS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1