Platform
wordpress
Component
top-friends
Fixed in
0.3.1
CVE-2025-12827 describes a Cross-Site Request Forgery (XSRF) vulnerability affecting the Top Friends plugin for WordPress. This vulnerability allows unauthenticated attackers to potentially modify plugin settings. The issue impacts versions 0.0.0 through 0.3. A fix is available in a subsequent, unlisted version.
An attacker can exploit this XSRF vulnerability by crafting a malicious request that appears to originate from a legitimate user. If a site administrator clicks on this crafted link, the attacker can execute arbitrary actions within the Top Friends plugin, such as modifying settings or potentially gaining unauthorized access to sensitive data. The blast radius is limited to the plugin's functionality, but successful exploitation could lead to configuration changes impacting site functionality or user experience. This vulnerability highlights the importance of proper nonce validation in WordPress plugins to prevent unauthorized modifications.
This CVE was publicly disclosed on 2025-11-18. There are currently no known public exploits or active campaigns targeting this vulnerability. The EPSS score is pending evaluation. Monitor WordPress security advisories and plugin updates for further information.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-12827 is to upgrade the Top Friends plugin to a version that includes the necessary nonce validation fixes. As a temporary workaround, consider implementing stricter access controls for plugin settings, limiting who can modify them. Web Application Firewalls (WAFs) can be configured to detect and block suspicious requests targeting the topfriendsoptions_subpanel() function. Regularly review WordPress plugin configurations and user permissions to identify and address potential vulnerabilities.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-12827 is a Cross-Site Request Forgery (XSRF) vulnerability in the Top Friends WordPress plugin, allowing attackers to potentially modify plugin settings.
You are affected if your WordPress site uses the Top Friends plugin in versions 0.0.0 through 0.3.
Upgrade the Top Friends plugin to a version that includes the necessary nonce validation fixes. Check the plugin developer's website for updates.
As of now, there are no known public exploits or active campaigns targeting this vulnerability, but it's crucial to apply the fix.
Check the Top Friends plugin developer's website or the WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.