Cross-Site Request Forgery in Spreadsheet Integration Plugin for WordPress
CVE-2025-1463
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 March 2025
What is CVE-2025-1463?
The Spreadsheet Integration plugin for WordPress contains a security flaw that allows unauthenticated attackers to exploit Cross-Site Request Forgery (CSRF) vulnerabilities. This is attributed to inadequate nonce validation in the class-wpgsi-show.php script. Attackers can trick an administrator into executing unintended actions, such as publishing arbitrary posts, including private ones, by clicking on a malicious link. This vulnerability impacts all versions of the plugin up to and including 3.8.2, posing a significant risk to WordPress sites utilizing this plugin.
Affected Version(s)
Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. * <= 3.8.2