CVE-2025-31032: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway plugin affecting versions through 2.7.1. The vulnerability was disclosed on April 9, 2025, and was assigned CVE-2025-31032. This security issue allows for Stored Cross-Site Scripting (XSS) attacks (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-352 (Cross-Site Request Forgery) and allows attackers to potentially execute stored XSS attacks through CSRF vulnerabilities (NVD).

This vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The CSRF vulnerability can be leveraged to inject stored XSS payloads, potentially affecting the security of the WordPress installation (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, though it requires user interaction. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 2.8.0 of the Pagopar – WooCommerce Gateway plugin. Users are advised to update to version 2.8.0 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).