CVE-2025-5937

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-593707.5A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potent CVE-2025-593717.5An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili CVE-2025-593738.5A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when a CVE-2025-593749.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro CVE-2025-593757.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi CVE-2025-593765.3feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele CVE-2025-593779.8feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is us CVE-2025-593785.7In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular CVE-2025-593797.5DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying S CVE-2025-59384.3The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers CVE-2025-593804.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat