CVE-2025-8669CWE-352csrf

CVE-2025-8669

Medium · published October 3, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-03T16:15Z
References (5)
https://research.cleantalk.org/cve-2025-8669/ · [email protected]https://themes.trac.wordpress.org/browser/customify/0.4.11/inc/customizer/class-customizer.php#L55 · [email protected]https://themes.trac.wordpress.org/changeset/291160/customify/0.4.12/inc/customizer/class-customizer.php · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/a3425d78-1e24-4224-bfdc-a3e11735384f?source=cve · [email protected]https://research.cleantalk.org/cve-2025-8669/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 11:17Z
    Customify <= 0.4.11 - Cross-Site Request Forgery
    cvelistv5