CVE-2025-49237 HIGH

CVE-2025-49237: WordPress POEditor plugin <= 0.9.10 - CSRF to Arbitrary File Deletion vulnerability

Vendor Poeditor
Product POEditor
Weakness CWE-352 · CSRF
Published June 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through <= 0.9.10.

Explanation of Vulnerability in Simple Terms

02Summary

POEditor versions up to 0.9.10 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in POEditor user, performs unwanted actions on their behalf without their knowledge. The attack requires the user to visit the attacker's page while authenticated to POEditor. This can lead to unauthorized changes or disruption of service.

What an attacker can do

03Attacker Capabilities

Perform actions on a POEditor account without the user's consent by tricking them into visiting a malicious webpage.

Potential impact on your site

04Site Impact

Users' POEditor accounts can be compromised to make unauthorized changes to translations or project settings.

Conditions required to exploit

05Prerequisites

The victim must be logged into POEditor and visit an attacker-controlled webpage.

Key dates

06Disclosure timeline

June 6, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2021-4427 Vuukle Comments, Reactions, Share Bar, Revenue <= 3.4.31 - Cross-Site Request Forgery Bypass CVE-2025-52784 WordPress Bluff Post plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2020-3114 Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint CVE-2023-24415 WordPress AI ChatBot plugin <= 4.2.8 is vulnerable to Cross Site Request Forgery (CSRF)