Cyber Resilience

CVE-2025-23922

Critical

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0497 89.9th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23922 is a critical-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw, tracked as CVE-2025-23922 with a CVSS score of 10.0, present in the iSpring Embedder WordPress plugin (embed-ispring) developed by Harsh. It affects all versions from n/a through 1.0 and enables an attacker to upload a web shell to the underlying web server, corresponding to CWE-352.

An unauthenticated remote attacker can exploit the issue over the network with low complexity to achieve arbitrary file upload. Successful exploitation grants full control over the affected WordPress site and server, including the ability to execute arbitrary code via the uploaded web shell.

The Patchstack advisory identifies the flaw as a CSRF-to-arbitrary-file-upload vulnerability in the WordPress iSpring Embedder plugin at version 1.0 and provides a public database entry for further details on the affected component.

EPSS remains flat at 0.0497 with no material rise observed, indicating limited exploitation interest to date.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

CSRF in public-facing WordPress plugin directly enables arbitrary file upload of web shell, mapping to exploitation of public-facing application and web shell deployment for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-37054Shared CWE-352
CVE-2024-13913Shared CWE-352
CVE-2018-25176Shared CWE-352
CVE-2025-11087Shared CWE-352
CVE-2026-39619Shared CWE-352
CVE-2024-11641Shared CWE-352
CVE-2026-33507Shared CWE-352
CVE-2026-39617Shared CWE-352
CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires session authenticity protections such as anti-CSRF tokens, directly preventing exploitation of this CSRF vulnerability that enables unauthorized web shell uploads.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation and sanitization of inputs, blocking malicious web shell files from being uploaded through the vulnerable endpoint.

SI-3 Malicious Code Protection partial match
preventdetect

SI-3 deploys malicious code protection mechanisms to scan and prevent or detect web shell uploads on the web server.

References