Cross-Site Request Forgery in WP Video Posts by WordPress
CVE-2025-27298

8.3HIGH

Key Information:

Vendor

WordPress
Status
WP Video Posts
Vendor
CVE Published:
24 February 2025

What is CVE-2025-27298?

A Cross-Site Request Forgery (CSRF) vulnerability in the WP Video Posts plugin for WordPress allows attackers to perform unauthorized actions. This security flaw could facilitate OS Command Injection, posing significant risks to affected users. The vulnerability affects all versions from n/a through 3.5.1, making it essential for site administrators to update their plugins to mitigate potential exploitation.

Affected Version(s)

WP Video Posts <= 3.5.1

References

https://patchstack.com/database/wordpress/plugin/wp-video...
vdb-entry

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

johska (Patchstack Alliance)
.