CVE-2025-13144 affects the ContentStudio plugin for WordPress, specifically versions up to and including 1.3.7, due to a Cross-Site Request Forgery (CSRF) vulnerability. This medium-severity flaw (CVSS 4.3) stems from insufficient nonce validation in the add_cstu_settings function, allowing unauthenticated attackers to modify plugin settings. Exploitation requires tricking a site administrator into clicking a malicious link, but there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 1.3.7CPE match | cpe:2.3:a:contentstudio:contentstudio:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.