CVE-2025-23900
Published: 16 January 2025
Summary
CVE-2025-23900 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23900 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Genkisan Genki Announcement WordPress plugin (genki-announcement). It affects all versions from n/a through 1.4.1. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction dependency, and cross-scope impact with low confidentiality, integrity, and availability effects. The issue was published on 2025-01-16.
Unauthenticated attackers (PR:N) can exploit this CSRF flaw over the network (AV:N) by tricking authenticated users into performing unintended actions, such as submitting malicious requests via a forged webpage or link that requires user interaction (UI:R), like clicking a button. Successful exploitation changes scope (S:C) and enables limited impacts: low-level compromise of confidentiality (C:L), integrity (I:L), and availability (A:L), potentially allowing unauthorized modifications or data exposure within the plugin's context.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/genki-announcement/vulnerability/wordpress-genki-announcement-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve details the vulnerability, referring to it as a CSRF-to-stored-XSS issue in Genki Announcement plugin version 1.4.1; security practitioners should consult this for specific patch or mitigation guidance, such as updating to a fixed version if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3518
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in genkisan Genki Announcement genki-announcement allows Cross Site Request Forgery.This issue affects Genki Announcement: from n/a through <= 1.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly maps to T1190 for exploitation; CSRF-to-stored-XSS enables browser session hijacking via T1185.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CSRF vulnerability by enforcing session authenticity mechanisms like anti-CSRF tokens to prevent forged requests from tricking authenticated users into unintended actions in the Genki Announcement plugin.
Validates information inputs to the plugin, ensuring CSRF tokens or request origins are checked to block malicious forged requests leading to stored XSS.
Requires identification and timely patching of the specific CSRF flaw in Genki Announcement versions through <=1.4.1, eliminating the vulnerability at its source.