CVE-2025-1530

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1530
The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php Product
https://plugins.trac.wordpress.org/changeset/3251202/ Patch
https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php Product
https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/results.php Patch
https://wordpress.org/plugins/tripetto/#developers Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tripetto:tripetto:*:*:*:*:*:wordpress:*:*
History

25 Mar 2025, 20:02

Type Values Removed Values Added
CPE cpe:2.3:a:tripetto:tripetto:*:*:*:*:*:wordpress:*:*
First Time Tripetto tripetto
Tripetto
References () https://plugins.trac.wordpress.org/changeset/3251202/ - () https://plugins.trac.wordpress.org/changeset/3251202/ - Patch
References () https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php - () https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/results.php - () https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/results.php - Patch
References () https://wordpress.org/plugins/tripetto/#developers - () https://wordpress.org/plugins/tripetto/#developers - Product
References () https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php - () https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php - Product

15 Mar 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-15 12:15

Updated : 2025-03-25 20:02

NVD link : CVE-2025-1530

Mitre link : CVE-2025-1530

JSON object : View

Products Affected

tripetto

  • tripetto
CWE
CWE-352

Cross-Site Request Forgery (CSRF)