Plugin WordPress Rencontre <= 3.13.7 - Vulnerabilidad de Cross Site Request Forgery (CSRF)

The CSRF vulnerability in Rencontre allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successfully exploiting this vulnerability can lead to Stored XSS, where malicious JavaScript code is stored on the server and executed when other users visit affected pages. This can result in session hijacking, defacement of the website, redirection to malicious sites, or the theft of sensitive user data. The impact is amplified if the plugin is used in environments with privileged user roles, as an attacker could potentially gain administrative access to the WordPress site.

WordPress websites utilizing the Rencontre plugin, particularly those with user roles that have administrative privileges, are at risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk, as they may be slower to apply security patches.

• wordpress / composer / npm:

grep -r 'rencontre/plugin.php' /var/www/html/
wp plugin list | grep rencontre

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/rencontre/plugin.php | grep -i '3.13.7'

1. 2025-12-09Disclosure

   disclosure

1. Reservado2025-12-09
2. Publicada2025-12-09
3. Modificada2026-04-28
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-67534 is to immediately upgrade the Rencontre WordPress plugin to version 3.13.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests with suspicious CSRF tokens. Additionally, ensure that all user input is properly validated and sanitized to prevent the injection of malicious code. After upgrading, verify the fix by attempting to submit a request with a crafted CSRF token to a sensitive plugin endpoint.

Instalaciones activas

300Nicho

Valoración del plugin