CVE-2025-47594: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in DAEXT Soccer Live Scores plugin affecting versions through 1.0.5. The vulnerability was reported on May 7, 2025, by security researcher ch4r0n from FPT Software (Patchstack, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with no impact on confidentiality, low impact on integrity, and no impact on availability (Wiz, NVD).

The vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The software is considered abandoned as it was last updated over a year ago and will likely not receive further updates or fixes (Patchstack).

The vulnerability requires user interaction and has a low attack complexity. No public exploits have been reported at this time (Wiz).

As there is no official fix available, the recommended mitigation is to remove and replace the software with an alternative solution. Note that merely deactivating the software does not remove the security threat unless a virtual patch (vPatch) is deployed (Patchstack).