Cross-Site Request Forgery Vulnerability in Backwp by wphobby
CVE-2025-28954

7.4HIGH

Key Information:

Vendor

WordPress
Status
BackWP
Vendor
CVE Published:
6 June 2025

What is CVE-2025-28954?

The vulnerability in Backwp allows attackers to exploit a Cross-Site Request Forgery (CSRF) flaw, which can lead to unauthorized actions being performed on behalf of an authenticated user. This may result in permissions escalation and potential unauthorized access to system resources, making it crucial for users to update to the latest versions to mitigate risks.

Affected Version(s)

Backwp <= 2.0.2

References

https://patchstack.com/database/wordpress/plugin/backwp/v...
vdb-entry

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.
CVE-2025-28954 : Cross-Site Request Forgery Vulnerability in Backwp by wphobby