CVE-2025-28856

Medium

Published: 11 March 2025

Published

11 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Score 0.0016 36.8th percentile

Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28856 is a medium-severity CSRF (CWE-352) vulnerability in W3Counter W3Counter. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious Link (T1204.001). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the CSRF vulnerability by identifying, reporting, and correcting the flaw in the W3Counter WordPress plugin through patching or updates.

SC-23 Session Authenticity good match

prevent

Protects the authenticity of web communication sessions, directly countering CSRF attacks that forge requests on behalf of authenticated users.

SI-10 Information Input Validation good match

prevent

Validates information inputs such as CSRF tokens in plugin requests, preventing unauthorized state-changing actions from forged cross-site submissions.

MITRE ATT&CK Enterprise TechniquesAI

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

CSRF vulnerability requires tricking authenticated users into clicking a forged link or visiting a malicious site to trigger unauthorized actions, directly mapping to user execution via malicious link.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.

Deeper analysisAI

CVE-2025-28856 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the WordPress plugin W3Counter Free Real-Time Web Stats (blog-stats-by-w3counter) developed by dangrossman. The issue affects the plugin from unknown initial versions through version 4.1 inclusive. Published on 2025-03-11, it carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no required privileges, and user interaction needed.

Attackers can exploit this vulnerability remotely by tricking authenticated users into visiting a malicious site or clicking a forged link, leading to unauthorized actions on the victim's behalf. No privileges are required on the attacker's part, but exploitation depends on user interaction such as loading a malicious webpage. Successful attacks result in low integrity impact, potentially allowing modification of plugin-related data or settings without affecting confidentiality or availability.

The Patchstack advisory provides details on this vulnerability in the WordPress plugin, including assessment and recommended actions for mitigation. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve for patching guidance and verification steps.