Cyber Resilience

CVE-2025-6214

CSRF

Published
23 July 2025
Modified
17 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score 0.0016 6th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-6214 is a medium-severity CSRF (CWE-352) vulnerability in Wordpress (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permission_callback only verifies that the requester is logged in, but fails to require any…

more

nonce or other proof of intent. This makes it possible for unauthenticated attackers to delete arbitrary user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CSRF on a WordPress REST route allows an attacker to trick an authenticated administrator into performing an action (clicking a malicious link) that deletes user accounts. This directly maps to T1204.001 (Malicious Link) for the delivery vector and T1190 (Exploit Public-Facing Application) because the vulnerable plugin exposes the flawed REST endpoint on a public-facing WordPress site.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-9623Shared CWE-352
CVE-2025-25100Shared CWE-352
CVE-2024-56903Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25148Shared CWE-352
CVE-2025-1764Shared CWE-352
CVE-2025-6059Shared CWE-352
CVE-2025-23872Shared CWE-352
CVE-2025-30787Shared CWE-352
CVE-2025-25107Shared CWE-352

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • SC-23 Session Authenticity
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires the /users/delete REST handler to enforce proper authorization (including nonce validation) rather than accepting any authenticated session.

prevent

Mandates validation of all request inputs, ensuring the presence and correctness of anti-CSRF tokens before processing delete actions.

prevent

Requires mechanisms that bind requests to an authentic, unforgeable session context, blocking cross-site submission of privileged actions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References