Cross-Site Request Forgery Vulnerability in Contact Form 7 Select Box Editor Button by WordPress
CVE-2025-28902

4.3MEDIUM

Key Information:

Vendor
WordPress
Status
Contact Form 7 Select Box Editor Button
Vendor
CVE Published:
11 March 2025

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Contact Form 7 Select Box Editor Button of WordPress. This vulnerability could allow an attacker to exploit the editor button, potentially leading to unauthorized actions being executed on behalf of authenticated users without their knowledge. Users of affected versions, specifically from n/a through 0.6, should take immediate action to mitigate the risks associated with this issue.

Affected Version(s)

Contact Form 7 Select Box Editor Button <= 0.6

References

https://patchstack.com/database/wordpress/plugin/contact-...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.
CVE-2025-28902 : Cross-Site Request Forgery Vulnerability in Contact Form 7 Select Box Editor Button by WordPress | SecurityVulnerability.io