Cyber Resilience

CVE-2025-24717

Medium

Published: 24 January 2025

Published
24 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
EPSS Score 0.0013 32.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24717 is a medium-severity CSRF (CWE-352) vulnerability in Wow-Company Modal Window. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-24717 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Wow-Company Modal Window plugin (modal-window) for WordPress. The issue allows CSRF attacks and affects all versions from n/a through 6.1.4. It carries a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), indicating medium severity with no confidentiality impact but low integrity and availability effects.

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it demands user interaction such as clicking a malicious link or visiting a crafted page. Any unauthenticated adversary can trick authenticated WordPress administrators or users with sufficient permissions into performing unintended actions, leading to changes in plugin settings.

The Patchstack advisory documents this as a CSRF-to-settings-change vulnerability specifically in Modal Window plugin version 6.1.4 and provides details on the issue for mitigation guidance. Security practitioners should consult the advisory at https://patchstack.com/database/Wordpress/Plugin/modal-window/vulnerability/wordpress-modal-window-plugin-6-1-4-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve for patching instructions and verification steps.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of the application to perform unauthorized settings changes.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

wow-company
modal window
≤ 6.1.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely identification, reporting, and correction of the CSRF flaw in the Modal Window plugin prevents exploitation of this specific vulnerability.

SC-23 Session Authenticity good match
prevent

Requires session authenticity mechanisms such as CSRF tokens to assure the legitimacy of requests, directly countering forged cross-site requests to change plugin settings.

SI-10 Information Input Validation partial match
prevent

Validates information inputs to plugin settings endpoints, mitigating forged CSRF requests by rejecting invalid or unauthorized inputs.

References