CVE-2025-25101 CRITICAL

CVE-2025-25101: WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability

Vendor Metricthemes
Product Munk Sites
Weakness CWE-352 · CSRF
Published February 7, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.

Explanation of Vulnerability in Simple Terms

02Summary

Munk Sites versions 0 through 1.0.7 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability requires user interaction—the victim must visit a malicious page or click a crafted link while authenticated. Successful exploitation can result in data theft, site modification, or service disruption.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions (data theft, site modification, or service disruption) on behalf of a logged-in user.

Potential impact on your site

04Site Impact

An attacker can modify site content, steal data, or disable the site by tricking authenticated users into performing unwanted actions.

Conditions required to exploit

05Prerequisites

Victim must be logged in and visit an attacker-controlled page or click a malicious link.

Key dates

06Disclosure timeline

February 7, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-57751 WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability