प्लेटफ़ॉर्म
wordpress
घटक
top-friends
में ठीक किया गया
0.3.1
CVE-2025-12827 describes a Cross-Site Request Forgery (XSRF) vulnerability affecting the Top Friends plugin for WordPress. This vulnerability allows unauthenticated attackers to potentially modify plugin settings. The issue impacts versions 0.0.0 through 0.3. A fix is available in a subsequent, unlisted version.
An attacker can exploit this XSRF vulnerability by crafting a malicious request that appears to originate from a legitimate user. If a site administrator clicks on this crafted link, the attacker can execute arbitrary actions within the Top Friends plugin, such as modifying settings or potentially gaining unauthorized access to sensitive data. The blast radius is limited to the plugin's functionality, but successful exploitation could lead to configuration changes impacting site functionality or user experience. This vulnerability highlights the importance of proper nonce validation in WordPress plugins to prevent unauthorized modifications.
This CVE was publicly disclosed on 2025-11-18. There are currently no known public exploits or active campaigns targeting this vulnerability. The EPSS score is pending evaluation. Monitor WordPress security advisories and plugin updates for further information.
WordPress websites using the Top Friends plugin, particularly those with site administrators who are susceptible to social engineering attacks. Shared hosting environments where plugin updates are managed centrally are also at increased risk.
• wordpress / composer / npm:
grep -r 'top_friends_options_subpanel' /var/www/html/wp-content/plugins/• generic web:
curl -I https://your-wordpress-site.com/wp-admin/admin.php?page=top-friends-settings | grep -i 'top_friends_options_subpanel'disclosure
एक्सप्लॉइट स्थिति
EPSS
0.03% (8% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-12827 is to upgrade the Top Friends plugin to a version that includes the necessary nonce validation fixes. As a temporary workaround, consider implementing stricter access controls for plugin settings, limiting who can modify them. Web Application Firewalls (WAFs) can be configured to detect and block suspicious requests targeting the topfriendsoptions_subpanel() function. Regularly review WordPress plugin configurations and user permissions to identify and address potential vulnerabilities.
कोई ज्ञात पैच उपलब्ध नहीं है। कृपया भेद्यता (vulnerability) के विवरण की गहराई से समीक्षा करें और अपने संगठन के जोखिम सहनशीलता (risk tolerance) के आधार पर शमन (mitigations) को लागू करें। प्रभावित सॉफ़्टवेयर को अनइंस्टॉल करना और एक प्रतिस्थापन खोजना सबसे अच्छा हो सकता है।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-12827 is a Cross-Site Request Forgery (XSRF) vulnerability in the Top Friends WordPress plugin, allowing attackers to potentially modify plugin settings.
You are affected if your WordPress site uses the Top Friends plugin in versions 0.0.0 through 0.3.
Upgrade the Top Friends plugin to a version that includes the necessary nonce validation fixes. Check the plugin developer's website for updates.
As of now, there are no known public exploits or active campaigns targeting this vulnerability, but it's crucial to apply the fix.
Check the Top Friends plugin developer's website or the WordPress plugin repository for the official advisory and update information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।