Cross-Site Request Forgery Vulnerability in Ajax Comment Form CST Plugin for WordPress
CVE-2025-3867
6.1MEDIUM
What is CVE-2025-3867?
The Ajax Comment Form CST plugin for WordPress is susceptible to Cross-Site Request Forgery, allowing unauthorized attackers to exploit weaknesses in nonce validation on the 'acform_cst_settings' page. Without proper nonce checks, attackers can potentially trick site administrators into executing malicious actions, such as changing configurations or injecting harmful scripts, simply by enticing them to click on a deceptive link. This vulnerability underscores the necessity for robust validation mechanisms to prevent unauthorized settings manipulation.
Affected Version(s)
Ajax Comment Form CST * <= 1.2
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Johannes Skamletz