CVE-2025-28864

Medium

Published: 11 March 2025

Published

11 March 2025

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Score 0.0013 32.8th percentile

Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28864 is a medium-severity CSRF (CWE-352) vulnerability in Planetstudio Builder For Contact Form 7. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the CSRF vulnerability in the Builder for Contact Form 7 plugin by identifying, reporting, and applying patches to affected versions up to 1.2.2.

SC-23 Session Authenticity good match

prevent

Protects against CSRF attacks like CVE-2025-28864 by enforcing session authenticity mechanisms to validate requests and prevent forged submissions by unauthenticated attackers tricking admins.

SI-10 Information Input Validation partial match

prevent

Mitigates CSRF exploitation in the plugin by requiring validation of inputs such as anti-CSRF tokens on state-changing requests that modify settings.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

CSRF vulnerability in public-facing WordPress plugin enables exploitation of the app (T1190) via attacker-crafted malicious links/webpages that trick authenticated users into performing unauthorized actions (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.

Deeper analysisAI

CVE-2025-28864 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Builder for Contact Form 7 by Webconstruct WordPress plugin (cf7-builder). This issue affects all versions of the plugin from n/a through 1.2.2, allowing CSRF attacks against the plugin's functionality.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating exploitation over the network with low attack complexity, no privileges required, but user interaction needed from the target. Unauthenticated attackers can trick authenticated users, such as site administrators, into submitting malicious requests via a forged webpage, resulting in low-impact integrity effects like unauthorized modifications to plugin settings or data.

The Patchstack advisory documents this CSRF vulnerability in Builder for Contact Form 7 by Webconstruct version 1.2.2, providing details for security practitioners to assess and address exposure in affected WordPress installations: https://patchstack.com/database/Wordpress/Plugin/cf7-builder/vulnerability/wordpress-builder-for-contact-form-7-by-webconstruct-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.