CVE-2025-28856
Published: 11 March 2025
Summary
CVE-2025-28856 is a medium-severity CSRF (CWE-352) vulnerability in W3Counter W3Counter. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 37.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28856 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the WordPress plugin W3Counter Free Real-Time Web Stats (blog-stats-by-w3counter) developed by dangrossman. The issue affects the plugin from unknown initial versions through version 4.1 inclusive. Published on 2025-03-11, it carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no required privileges, and user interaction needed.
Attackers can exploit this vulnerability remotely by tricking authenticated users into visiting a malicious site or clicking a forged link, leading to unauthorized actions on the victim's behalf. No privileges are required on the attacker's part, but exploitation depends on user interaction such as loading a malicious webpage. Successful attacks result in low integrity impact, potentially allowing modification of plugin-related data or settings without affecting confidentiality or availability.
The Patchstack advisory provides details on this vulnerability in the WordPress plugin, including assessment and recommended actions for mitigation. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve for patching guidance and verification steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7827
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability requires tricking authenticated users into clicking a forged link or visiting a malicious site to trigger unauthorized actions, directly mapping to user execution via malicious link.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CSRF vulnerability by identifying, reporting, and correcting the flaw in the W3Counter WordPress plugin through patching or updates.
Protects the authenticity of web communication sessions, directly countering CSRF attacks that forge requests on behalf of authenticated users.
Validates information inputs such as CSRF tokens in plugin requests, preventing unauthorized state-changing actions from forged cross-site submissions.