CVE-2025-23532
Published: 16 January 2025
Summary
CVE-2025-23532 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly patches the CSRF vulnerability in the MyAnime Widget plugin, preventing privilege escalation exploits.
Session authenticity mechanisms, such as CSRF tokens, protect against forged requests that trick authenticated users into privilege escalation.
Information input validation enforces CSRF token checks on plugin endpoints, blocking unauthorized privilege escalation requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables remote exploitation of the application (T1190) and facilitates privilege escalation for the attacker (T1068) via forged requests tricking authenticated users.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-23532 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Regios MyAnime Widget (myanime-widget) WordPress plugin. This issue affects versions from n/a through <=1.0 and allows privilege escalation. The vulnerability received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low attack complexity, no required privileges, and high impacts on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this CSRF vulnerability remotely by tricking an authenticated user, such as an administrator, into interacting with a malicious webpage or link. This user interaction submits a forged request to the plugin, enabling privilege escalation for the attacker without their prior authentication on the target site.
Patchstack has issued an advisory on this vulnerability in MyAnime Widget plugin version 1.0, available at https://patchstack.com/database/Wordpress/Plugin/myanime-widget/vulnerability/wordpress-myanime-widget-plugin-1-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve, which security practitioners should consult for details on patches and mitigation steps. The CVE was published on 2025-01-16T20:15:38.783.
Details
- CWE(s)