CVE-2025-64288: 
WordPress vulnerability analysis and mitigation

CVE-2025-64288 is a Cross-Site Request Forgery (CSRF) vulnerability in the Premmerce WordPress plugin affecting all versions up to and including 1.3.19. The vulnerability was reported by researcher Nabil Irawan on April 10, 2025, published by Patchstack on May 10, 2025, and assigned a CVE on October 29, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate the origin of state-changing HTTP requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, causes the victim's browser to submit unauthorized requests to the Premmerce plugin on their behalf. Exploitation requires no special privileges from the attacker but does require user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated (Patchstack).

Successful exploitation allows an attacker to force higher-privileged WordPress users to execute unwanted administrative actions under their current authentication context, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, but depending on the actions exposed by the plugin, this could include unauthorized configuration changes or data manipulation within the Premmerce plugin's functionality (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat, though they note that CSRF vulnerabilities of this type can be used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Premmerce plugin version 1.3.19 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Identify target action: Determine which state-changing actions within the Premmerce plugin lack CSRF token validation (e.g., plugin settings updates or administrative operations).
3. Craft malicious payload: Create an HTML page containing a hidden form or auto-submitting JavaScript that sends a forged POST/GET request to the target WordPress site's Premmerce plugin endpoint.
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page via phishing email, social engineering, or embedding the payload in a comment or external site.
5. Action executed: The victim's browser automatically submits the forged request with their valid session cookies, causing the Premmerce plugin to execute the attacker-specified action under the victim's privileges (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Premmerce plugin admin endpoints from unusual referrer URLs or external domains.
• Logs: Admin action logs (if enabled via audit plugins) recording configuration changes made during sessions where the administrator did not intentionally perform those actions.
• Network: HTTP requests to WordPress admin URLs associated with Premmerce functionality originating from external or unexpected referrer headers.

The vulnerability is patched in Premmerce plugin version 1.3.20. Site administrators should update the Premmerce plugin to version 1.3.20 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting access to the WordPress admin panel via IP allowlisting or using a web application firewall (WAF) with CSRF protection rules can reduce exposure (Patchstack).