CVE-2025-31616
Published: 31 March 2025
Summary
CVE-2025-31616 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31616 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the AdminGeekZ Varnish WordPress plugin known as varnish-wp. This issue affects Varnish WordPress versions from n/a through 1.7 inclusive. The vulnerability was published on 2025-03-31 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change with low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this CSRF vulnerability by tricking a victim—typically an authenticated WordPress administrator—into performing an unintended action, such as submitting a malicious request via a crafted webpage, email link, or image. Successful exploitation requires user interaction but no special privileges from the attacker. It enables the attacker to act as the victim, potentially leading to stored cross-site scripting (XSS) as indicated in related advisories.
Patchstack has documented this as a CSRF-to-stored XSS vulnerability specifically in Varnish WordPress plugin version 1.7, with details available in their vulnerability database.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8783
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPress: from n/a through <= 1.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vuln in public-facing WordPress plugin directly enables exploitation of the web app (T1190); leads to stored XSS enabling JavaScript execution in admin browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of system flaws like this CSRF vulnerability in the Varnish WordPress plugin, directly eliminating the issue through patching.
SC-23 enforces session authenticity mechanisms such as CSRF tokens, directly preventing forged requests that exploit this vulnerability by tricking authenticated administrators.
SI-10 mandates validation of information inputs, blocking malicious CSRF payloads submitted via crafted webpages or links targeting the vulnerable plugin.