CVE-2025-23821
Published: 16 January 2025
Summary
CVE-2025-23821 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the CSRF flaw in the WP Cookies Alert plugin by applying patches to prevent forged requests from modifying settings.
Protects communications session authenticity to block CSRF exploitation requiring user interaction with malicious pages while authenticated.
Validates inputs such as CSRF tokens on plugin endpoints to reject unauthorized forged requests that could alter configurations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of the web application to perform unauthorized actions like modifying settings.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in aleapp WP Cookies Alert wp-cookies-alert allows Cross Site Request Forgery.This issue affects WP Cookies Alert: from n/a through <= 1.1.1.
Deeper analysisAI
CVE-2025-23821 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP Cookies Alert WordPress plugin (wp-cookies-alert) developed by aleapp. This issue affects all versions of the plugin from n/a through 1.1.1 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1, reflecting network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), user interaction required (UI:R), changed scope (S:C), and low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L).
The vulnerability enables exploitation by remote attackers who can craft malicious requests to trick authenticated users into performing unintended actions on a vulnerable WordPress site, such as modifying plugin settings or configurations via forged cross-site requests. Exploitation requires the victim to interact with a malicious webpage (e.g., clicking a link or loading a page) while authenticated to the target site, allowing the attacker to leverage the user's session without their knowledge. Successful attacks could result in low-level disruptions to data confidentiality, integrity, and availability within the changed scope.
Mitigation details are outlined in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-cookies-alert/vulnerability/wordpress-wp-cookies-alert-plugin-1-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve, which addresses the CSRF issue in WP Cookies Alert version 1.1.1. Security practitioners should review this reference for patching guidance and verify updates beyond version 1.1.1.
Details
- CWE(s)