WordPress Plugin Vulnerabilities

Maintenance Notice < 1.0.7 - Settings Reset via CSRF

Description

The plugin does not have CSRF check when reseting its settings, which could allow attackers to make logged in users perform such action via a CSRF attack

Affects Plugins

Plugin icon
maintenance-notice
Fixed in 1.0.7

References

CVE
CVE-2025-28859
URL
https://patchstack.com/database/wordpress/plugin/maintenance-notice/vulnerability/wordpress-maintenance-notice-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
Yes
WPVDB ID
aa606561-24b6-4256-b3cc-07893c2cc0dc

Timeline

Publicly Published
2025-03-11 (about 1 year ago)
Added
2025-03-17 (about 1 year ago)
Last Updated
2025-03-24 (about 1 year ago)

Other

Published
Title
Published
2025-12-12
Title
WPBookit <= 1.0.7 - Customer Deletion via CSRF
Published
2025-05-16
Title
ValidateCertify <= 1.6.4 - Cross-Site Request Forgery
Published
2026-02-11
Title
Easy Table of Contents < 2.0.81 - Cross-Site Request Forgery
Published
2023-07-10
Title
Multiple Plugins from Addify - Multiple CSRF
Published
2026-04-30
Title
WP Editor < 1.2.9.3 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor