WordPress Plugin Vulnerabilities

ValidateCertify <= 1.6.4 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
validar-certificados-de-cursos
No known fix

References

CVE
CVE-2025-48115
URL
https://patchstack.com/database/wordpress/plugin/validar-certificados-de-cursos/vulnerability/wordpress-validatecertify-1-6-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
a16633bb-70d4-4c56-8736-bb6509ac9dee

Timeline

Publicly Published
2025-05-16 (about 1 year ago)
Added
2025-05-21 (about 1 year ago)
Last Updated
2025-09-03 (about 1 year ago)

Other

Published
Title
Published
2025-03-27
Title
wpShopGermany IT-RECHT KANZLEI < 2.1 - Cross-Site Request Forgery
Published
2023-03-16
Title
Hotel Booking Lite < 4.7.0 - Settings Update via CSRF
Published
2025-04-24
Title
Milat jQuery Automatic Popup <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting
Published
2021-03-01
Title
WP Private Content Plus < 3.2 - Cross-Site Request Forgery
Published
2024-04-10
Title
Smash Balloon Social Post Feed < 4.2.2 - Facebook Token Reset/Update via CSRF