Cross-Site Request Forgery Vulnerability in WordPress Automatic Plugin
CVE-2025-6247

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
WordPress Automatic Plugin
Vendor
CVE Published:
26 August 2025

What is CVE-2025-6247?

The WordPress Automatic Plugin for WordPress is vulnerable to Cross-Site Request Forgery due to inadequate nonce validation in its functionalities. This flaw allows unauthenticated attackers to potentially manipulate campaigns or inject malicious scripts via impersonated requests, provided they can deceive a site administrator into executing an action such as clicking a harmful link. This vulnerability affects all versions of the plugin up to and including 3.118.0.

Affected Version(s)

WordPress Automatic Plugin * <= 3.118.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/wordpress-automatic-plugin/19...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc)
.