CVE-2025-23901
Published: 16 January 2025
Summary
CVE-2025-23901 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23901 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the GravatarLocalCache WordPress plugin developed by cybio under the gravatarlocalcache package. This issue affects all versions from n/a through 1.1.2, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Published on 2025-01-16, it enables CSRF attacks against the plugin's functionality.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no required privileges, but it relies on user interaction such as tricking an authenticated user—typically a site administrator—into visiting a malicious webpage or clicking a crafted link. Successful exploitation changes the security scope and results in low impacts to confidentiality, integrity, and availability, potentially allowing actions like stored cross-site scripting (XSS) as indicated in vulnerability details.
Patchstack advisories document this as a CSRF-to-stored-XSS vulnerability specifically in GravatarLocalCache plugin version 1.1.2, providing further technical analysis for mitigation guidance. Security practitioners should review the referenced advisory at https://patchstack.com/database/Wordpress/Plugin/gravatarlocalcache/vulnerability/wordpress-gravatarlocalcache-plugin-1-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve and apply updates or workarounds as recommended.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3519
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in cybio GravatarLocalCache gravatarlocalcache allows Cross Site Request Forgery.This issue affects GravatarLocalCache: from n/a through <= 1.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of Internet-facing web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of flaws, directly mitigating this CVE by patching the CSRF vulnerability in the GravatarLocalCache plugin.
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, preventing forged requests that exploit this CSRF-to-stored-XSS vulnerability.
SI-10 provides input validation to restrict malicious payloads, mitigating the stored XSS impact resulting from successful CSRF exploitation.