CVE-2025-60113 MEDIUM

CVE-2025-60113: WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Vendor Grooni
Product Groovy Menu
Weakness CWE-352 · CSRF
Published September 26, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.

Explanation of Vulnerability in Simple Terms

02Summary

Groovy Menu versions up to 1.4.3 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site visitors. An attacker can craft a malicious link or page that, when visited by a logged-in user, triggers unwanted changes to menu settings or configuration. The vulnerability requires user interaction—the victim must click a link or visit a page—and does not expose sensitive data.

What an attacker can do

03Attacker Capabilities

Perform unauthorized menu configuration changes on behalf of a logged-in site visitor.

Potential impact on your site

04Site Impact

Menu settings could be altered without your knowledge if an admin or editor visits a malicious link while logged in.

Conditions required to exploit

05Prerequisites

Victim must be logged in and click an attacker-controlled link or visit a malicious page.

Key dates

06Disclosure timeline

September 26, 2025 CVE published
April 28, 2026 Record updated