CVE-2025-67473: CSRF in CWW Companion WordPress Plugin

The CSRF vulnerability in CWW Companion allows an attacker to craft malicious requests that appear to originate from a legitimate user. By tricking a user into clicking a crafted link or visiting a compromised website, an attacker could potentially modify settings, create or delete content, or perform other actions as if they were the authenticated user. The impact is amplified if the plugin has administrative privileges, potentially granting the attacker full control over the WordPress site. This could lead to data breaches, website defacement, or even complete compromise of the server.

1. Reserved2025-12-08
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the CWW Companion plugin to version 1.3.3 or later, which contains the fix. If upgrading immediately is not possible, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, carefully review and validate all user inputs to prevent unexpected actions. Consider implementing stricter access controls and user permissions to limit the potential damage from a successful attack. After upgrading, confirm the vulnerability is resolved by attempting a CSRF attack and verifying it is blocked.

Active installs

1KNiche

Plugin rating