CVE-2025-23677: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in DSmidgy HTTP to HTTPS link changer by Eyga.net, affecting versions through 0.2.4. The vulnerability was initially reported on October 30, 2024, and was publicly disclosed on January 16, 2025. The security issue was identified by researcher SOPROBRO (Patchstack).

The vulnerability has been assigned CVE-2025-23677 and received a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-352 (Cross-Site Request Forgery) and allows for Stored Cross-Site Scripting attacks. The vulnerability requires no authentication to exploit, though user interaction is required (NVD, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The combination of CSRF with Stored XSS capabilities increases the potential impact of successful exploitation (Patchstack).

The vulnerability is classified as having low complexity (AC:L) and requires no privileges (PR:N) to exploit, though user interaction (UI:R) is necessary. The attack can be launched from the network vector (AV:N), making it remotely exploitable (Patchstack).

As of January 2025, no official fix is available for this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).