CVE-2025-58997CWE-352

WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

Critical · published September 9, 2025

CVSS v3.1
9.6
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

🚨 A dastardly CSRF vulnerability in Frenify Mow mow allows code injection, and it affects versions up to 4.10! 🔥 Think of this like handing out blank checks to every customer in a restaurant — if someone slips one in, they could fill it out for any amount they desire! An attacker could hijack a user's session and execute their malicious code, leading to unauthorized actions, data breaches, or even complete system takeovers. This is absolutely devastating and could put your entire application at risk!

Put simply

Think of this like handing out blank checks to every customer in a restaurant — if someone slips one in, they could fill it out for any amount they desire! This CSRF vulnerability allows attackers to exploit unsuspecting users by sending malicious requests that execute code in their context without their knowledge, bypassing normal security checks.

What to do

An attacker could hijack a user's session and execute their malicious code, leading to unauthorized actions, data breaches, or even complete system takeovers. This is absolutely devastating and could put your entire application at risk! Immediately patch Frenify Mow mow to version 4.11 or later to close this hole. Additionally, implement anti-CSRF tokens to strengthen your defenses and review your security practices! You've got this! Follow these steps and you'll lock down your application in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-09-09T16:33Z
EPSS history
Timeline
  • 09 SEP 16:33Z
    WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability
    cvelistv5