CSRF Vulnerability in Breaking News WP Plugin by WordPress
CVE-2025-31751

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Breaking News WP
Vendor
CVE Published:
1 April 2025

What is CVE-2025-31751?

The Breaking News WP plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows unauthorized users to execute actions on behalf of legitimate users, which could lead to unwanted changes in settings. This vulnerability affects versions of the plugin from an unspecified version up to 1.3, creating a significant risk for users who have not updated to secure versions. Patch your installations to mitigate the risk.

Affected Version(s)

Breaking News WP <= 1.3

References

https://patchstack.com/database/wordpress/plugin/breaking...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.