CVE-2025-23922 CRITICAL

CVE-2025-23922: WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

Vendor Harsh
Product iSpring Embedder
Weakness CWE-352 · CSRF
Published January 16, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

Explanation of Vulnerability in Simple Terms

02Summary

iSpring Embedder versions 1.0 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators without their knowledge or consent. The vulnerability requires no authentication and can be exploited remotely. An attacker can craft a malicious webpage that, when visited by an admin, executes unwanted commands on the site.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site by tricking an admin into visiting a malicious webpage.

Potential impact on your site

04Site Impact

Attackers can modify site content, change settings, or create accounts without your knowledge if an admin visits a malicious link.

Conditions required to exploit

05Prerequisites

An administrator must visit a webpage controlled by the attacker while logged into the site.

Key dates

06Disclosure timeline

January 16, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8902 AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update CVE-2026-8909 WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action CVE-2026-9618 PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink CVE-2026-10553 jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update