{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4337", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-05T15:45:30.529Z", "datePublished": "2025-05-06T04:24:12.780Z", "dateUpdated": "2026-04-08T17:15:29.820Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:29.820Z"}, "affected": [{"vendor": "mitchelllevy", "product": "AHAthat Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ahathat/trunk/includes/class-aha-admin-menu.php#L42"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "R\u00e9gis SENET"}], "timeline": [{"time": "2025-05-05T15:46:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-06T14:17:39.861388Z", "id": "CVE-2025-4337", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-06T14:18:15.629Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-06T14:17:39.861388Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-06T14:17:44.517Z"}}], "cna": {"title": "AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion", "credits": [{"lang": "en", "type": "finder", "value": "R\u00e9gis SENET"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mitchelllevy", "product": "AHAthat Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-05T15:46:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ahathat/trunk/includes/class-aha-admin-menu.php#L42"}], "descriptions": [{"lang": "en", "value": "The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:29.820Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4337", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:29.820Z", "dateReserved": "2025-05-05T15:45:30.529Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-06T04:24:12.780Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento AHAthat para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.6 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la funci\u00f3n aha_plugin_page(). Esto permite que atacantes no autenticados eliminen p\u00e1ginas AHA mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-4337", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-05-06T05:15:50.597", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ahathat/trunk/includes/class-aha-admin-menu.php#L42"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:56:52.351919+00:00", "value": {"mitigation_remediation": ["Upgrade the AHAthat Plugin to the latest version that includes proper nonce validation, or uninstall the plugin entirely if no patch is available.", "Verify that all administrative forms in the plugin use valid nonces and that no GET requests perform destructive actions.", "Consider limiting administrative access to trusted IP addresses or implementing two\u2011factor authentication to reduce the risk of accidental clicks on malicious links."], "summary": {"action": "Patch Now", "impact": "Unauthenticated Cross\u2011Site Request Forgery that permits deletion of AHA pages"}, "threat_synthesis": {"affected_systems": "Versions of the AHAthat Plugin up to and including 1.6, distributed by vendor mitchelllevy, are affected. The flaw exists in the core admin interface of the plugin and has no additional version restrictions beyond the 1.6 cutoff.", "description_and_impact": "The vulnerability resides in the AHAthat Plugin for WordPress and results from a missing or incorrect nonce validation in the aha_plugin_page() function. This classic CSRF flaw allows an attacker who tricks an administrator into visiting a crafted link to remove AHA pages without authentication, causing loss of content and potential disruption of site functionality. The weakness is identified as CWE\u2011352, reflecting the lack of proper request validation.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a social\u2011engineering step that convinces a site administrator to click a malicious link, after which the unauthenticated attacker can delete pages via the forged request."}}}}, "created": "2026-04-20T23:00:14.174199+00:00", "updated": "2026-04-20T23:00:14.174213+00:00", "vendors": []}