CVE-2025-31617
Published: 31 March 2025
Summary
CVE-2025-31617 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31617 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the PostmarkApp Email Integrator WordPress plugin developed by Gagan Deep Singh. The flaw affects all versions of the plugin from its initial release through 2.4. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change with low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by tricking authenticated users into performing unintended actions, such as submitting malicious requests via a crafted webpage, given the requirement for user interaction. Successful exploitation enables CSRF attacks that, as detailed in related advisories, can lead to stored cross-site scripting (XSS), allowing attackers to inject and persist malicious scripts executed in the context of other users viewing affected pages.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/postmarkapp-email-integrator/vulnerability/wordpress-postmarkapp-email-integrator-plugin-2-4-csrf-to-stored-xss-vulnerability?_s_id=cve) documents this as a CSRF-to-stored-XSS issue specifically in plugin version 2.4, providing technical details for security practitioners to assess and address the exposure in affected WordPress environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8768
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin enables remote exploitation (T1190) and facilitates persistent malicious JavaScript injection via stored XSS (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Protects session authenticity to directly prevent CSRF exploitation in the PostmarkApp Email Integrator plugin by rejecting forged requests from untrusted sources.
Validates information inputs to block malicious scripts injected via CSRF, mitigating the stored XSS consequence in this WordPress plugin vulnerability.
Requires timely flaw remediation, such as patching the PostmarkApp Email Integrator plugin up to version 2.4, to eliminate the CSRF-to-stored-XSS vulnerability.