CVE-2025-60164: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in NewsMAN NewsmanApp, affecting versions through 2.7.7. The vulnerability was initially reported by Nabil Irawan on July 31, 2025, and was publicly disclosed on September 26, 2025. The issue was assigned CVE-2025-60164 and received a CVSS v3.1 base score of 7.1 (High) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and received a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The technical assessment indicates that the vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs user interaction (UI:R). The scope is changed (S:C) with low impacts on confidentiality, integrity, and availability (NVD, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact is considered low severity but affects multiple security aspects including confidentiality, integrity, and availability (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. The issue affects NewsmanApp versions through 2.7.7, and users are advised to monitor for updates (Patchstack).