CSRF Vulnerability in POEditor by POEditor Inc.
CVE-2025-49237

7.4HIGH

Key Information:

Vendor

WordPress
Status
Poeditor
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49237?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the POEditor application that could allow attackers to manipulate the application’s functionality without the user’s consent. This could lead to unauthorized actions such as arbitrary file deletion. The issue affects all versions of POEditor from the earliest release up to version 0.9.10, making it essential for users to update to secure their systems against potential exploitation.

Affected Version(s)

POEditor <= 0.9.10

References

https://patchstack.com/database/wordpress/plugin/poeditor...
vdb-entry

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.