CVE-2025-23532

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0016 37.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23532 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23532 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Regios MyAnime Widget (myanime-widget) WordPress plugin. This issue affects versions from n/a through <=1.0 and allows privilege escalation. The vulnerability received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low attack complexity, no required privileges, and high impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this CSRF vulnerability remotely by tricking an authenticated user, such as an administrator, into interacting with a malicious webpage or link. This user interaction submits a forged request to the plugin, enabling privilege escalation for the attacker without their prior authentication on the target site.

Patchstack has issued an advisory on this vulnerability in MyAnime Widget plugin version 1.0, available at https://patchstack.com/database/Wordpress/Plugin/myanime-widget/vulnerability/wordpress-myanime-widget-plugin-1-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve, which security practitioners should consult for details on patches and mitigation steps. The CVE was published on 2025-01-16T20:15:38.783.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3233

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables remote exploitation of the application (T1190) and facilitates privilege escalation for the attacker (T1068) via forged requests tricking authenticated users.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1