Cross-Site Request Forgery in WP w3all phpBB Integration Plugin by w3all
CVE-2025-32274

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP W3all PHPbb
Vendor
CVE Published:
4 April 2025

What is CVE-2025-32274?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP w3all phpBB integration plugin, allowing an attacker to potentially perform unauthorized actions on behalf of the user. This issue impacts all versions from n/a up to 2.9.2, making it crucial for users to update and secure their WordPress installations against potential threats. Proper implementation of CSRF tokens is essential to mitigate this issue, ensuring that requests received by the application are genuine and originated from authenticated users.

Affected Version(s)

WP w3all phpBB <= 2.9.2

References

https://patchstack.com/database/wordpress/plugin/wp-w3all...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.