Cyber Resilience

CVE-2025-24001

High

Published: 21 January 2025

Published
21 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0010 27.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24001 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-24001 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the PPO Call To Actions WordPress plugin developed by Ngô Thắng IT. This issue affects all versions of the plugin from n/a through 0.1.3, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity by tricking authenticated users, such as administrators, into submitting malicious requests via user interaction. Successful exploitation enables CSRF actions that lead to stored XSS, resulting in low impacts to confidentiality, integrity, and availability with a changed scope.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ppo-call-to-actions/vulnerability/wordpress-ppo-call-to-actions-plugin-0-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigation steps such as updating to a patched version if available or disabling the plugin.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing WordPress plugin enables remote exploitation via malicious link to trigger unauthorized actions and stored XSS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352
CVE-2025-23445Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires session authenticity mechanisms such as anti-CSRF tokens to prevent forged requests from tricking authenticated users into performing unauthorized actions.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely flaw remediation, directly addressing this CVE by requiring patches for the vulnerable PPO Call To Actions WordPress plugin.

SI-10 Information Input Validation partial match
prevent

SI-10 enforces information input validation to block malicious payloads that enable stored XSS via the CSRF vulnerability.

References