CVE-2025-28876
Published: 11 March 2025
Summary
CVE-2025-28876 is a medium-severity CSRF (CWE-352) vulnerability in Skrill Skrill. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28876 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Skrill Official WordPress plugin for WooCommerce, developed by Skrill_Team. The flaw affects the official-skrill-woocommerce plugin from unknown initial versions through 1.0.66, enabling CSRF attacks on affected installations.
With a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), the vulnerability is exploitable over the network with low attack complexity and no privileges required, though it demands user interaction. An unauthenticated attacker can trick an authenticated user—such as a site administrator—into submitting a forged request via a malicious webpage, potentially leading to low-impact integrity violations like unauthorized changes to plugin configurations or actions.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/official-skrill-woocommerce/vulnerability/wordpress-skrill-official-plugin-1-0-65-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, which covers the CSRF issue in the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7843
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official official-skrill-woocommerce allows Cross Site Request Forgery.This issue affects Skrill Official: from n/a through <= 1.0.66.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly enables exploitation of the application for unauthorized actions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect communications session authenticity, directly preventing CSRF attacks that exploit valid user sessions with forged requests.
SI-10 enforces validation of information inputs, enabling checks for anti-CSRF tokens to block unauthorized state-changing requests in the vulnerable plugin.
SI-2 mandates timely identification, reporting, and correction of flaws, directly mitigating this CVE by patching the Skrill plugin to version beyond 1.0.66.