CVE-2025-58250: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ApusTheme Findgo, affecting versions through 1.3.55. The vulnerability was reported on September 22, 2025, by Tran Nguyen Bao Khanh from VCI - VNPT Cyber Immunity (NVD, Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and has received a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This scoring indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability allows authentication bypass through CSRF attacks. This could enable malicious actors to force higher privileged users to execute unwanted actions under their current authentication, potentially compromising the security of the affected WordPress installations (Patchstack).

The vulnerability has been fixed in version 1.3.60.1 of the Findgo theme. Users are advised to update to this version or later to remove the vulnerability. Despite the high CVSS score, Patchstack has classified this as a low-priority issue that is unlikely to be exploited (Patchstack).