{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9893", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T23:07:29.206Z", "datePublished": "2025-09-27T06:47:16.001Z", "dateUpdated": "2026-04-08T17:28:31.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:31.494Z"}, "affected": [{"vendor": "milankyada", "product": "VM Menu Reorder plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df7e57a7-ba15-4181-89f9-e3f1f5de36cf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vm-menu-reorder/trunk/vm-menu-class.php#L275"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-26T18:33:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T19:10:55.808162Z", "id": "CVE-2025-9893", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:11:05.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9893", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-29T19:10:55.808162Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:11:00.651Z"}}], "cna": {"title": "VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "milankyada", "product": "VM Menu Reorder plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T18:33:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df7e57a7-ba15-4181-89f9-e3f1f5de36cf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/vm-menu-reorder/trunk/vm-menu-class.php#L275"}], "descriptions": [{"lang": "en", "value": "The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:31.494Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9893", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:31.494Z", "dateReserved": "2025-09-02T23:07:29.206Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-27T06:47:16.001Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9893", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-27T07:15:34.273", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/vm-menu-reorder/trunk/vm-menu-class.php#L275"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df7e57a7-ba15-4181-89f9-e3f1f5de36cf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:27:07.277053+00:00", "value": {"mitigation_remediation": ["Upgrade the VM Menu Reorder plugin to the latest version that includes proper nonce verification.", "If an upgrade is not possible, temporarily disable or uninstall the plugin until a patch is available.", "Consider adding a site\u2011wide CSRF protection measure, such as a security plugin that enforces nonce checks for all sensitive requests."], "summary": {"action": "Apply patch", "impact": "Cross\u2011Site Request Forgery that resets menu settings via the VM Menu Reorder plugin"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the VM Menu Reorder plugin installed with version 1.0.0 or earlier are affected. The issue resides in the plugin\u2019s core code, and all administrators who use the default menu reordering functionality are at risk.", "description_and_impact": "The VM Menu Reorder plugin contains a missing or incorrect nonce validation in the vm_set_to_default function, allowing an attacker to forge a request that resets all menu reordering settings. The vulnerability can be leveraged by any unauthenticated user who tricks an administrator into visiting a crafted link, resulting in the administrator\u2019s menu configuration being overwritten. This flaw corresponds to CWE\u2011352 and enables attackers to alter the site\u2019s navigation structure, potentially disrupting user experience and facilitating further malicious activity.", "risk_and_exploitability": "The CVSS score of 4.3 reflects a moderate impact. The EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an administrator to be authenticated and to click a maliciously crafted link; no direct server\u2011side access is needed. Because the attacker can force a configuration reset, the risk is directed at administrative confidentiality and integrity rather than system compromise."}}}}, "created": "2025-09-29T09:29:50.599521+00:00", "updated": "2026-04-20T19:30:06.169028+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}