Cross-Site Request Forgery Vulnerability in Houzez Property Feed Plugin by WordPress
CVE-2025-0808

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
Houzez Property Feed
Vendor
CVE Published:
12 February 2025

Summary

The Houzez Property Feed plugin for WordPress is vulnerable due to inadequate nonce validation during the 'deleteexport' action, affecting all versions up to and including 2.4.21. This security issue allows unauthenticated attackers to exploit this loophole, potentially deleting property feed exports by tricking site administrators into performing actions through misleading links. Site owners must update the plugin to the latest version to mitigate this risk.

Affected Version(s)

Houzez Property Feed * <= 2.4.21

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3235031/houz...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dhabaleshwar Das
.