CVE-2025-64237: 
WordPress vulnerability analysis and mitigation

CVE-2025-64237 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Quick Interest Slider plugin by Graham, affecting all versions up to and including 3.1.5. The vulnerability was reported by researcher Nabil Irawan on October 30, 2025, published by Patchstack on November 29, 2025, and assigned a CVE on December 16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from the plugin's failure to implement adequate CSRF protections on sensitive administrative actions. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, silently submits forged requests to the plugin's endpoints on their behalf. Exploitation requires no special privileges from the attacker but does require user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions under their current authentication session, such as modifying plugin settings or other administrative operations. The primary impact is on integrity (unauthorized state changes), with limited confidentiality or availability consequences. The vulnerability is rated low priority by Patchstack and is considered unlikely to be exploited in a targeted manner, though CSRF vulnerabilities of this type can be leveraged in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-64237. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Quick Interest Slider plugin at version 3.1.5 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious payload: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged HTTP request to the target WordPress site's plugin endpoint (e.g., an admin-action URL associated with Quick Interest Slider settings).
3. Social engineering: Deliver the malicious link or page to a logged-in WordPress administrator via phishing email, comment, or other social engineering vector.
4. Trigger forged request: When the administrator visits the crafted page, their browser automatically submits the forged request with their authenticated session cookies, causing the plugin to execute the attacker-specified action without the user's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Quick Interest Slider plugin admin endpoints from unusual referrer URLs or external domains.
• Logs: Admin action logs reflecting plugin setting changes that the administrator does not recall making.
• Network: Requests to WordPress admin-ajax.php or plugin-specific admin URLs originating from external or unexpected referrer headers.

The vulnerability is patched in Quick Interest Slider version 3.1.6. Site administrators should update the plugin to version 3.1.6 or later immediately. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin panel to trusted IP addresses. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).