Description
The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-03-01
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-5908 The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
History

Wed, 08 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
Description The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Simple:Press <= 6.10.11 - Cross-Site Request Forgery to Unauthorized Post Editing Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing
References

Tue, 12 Aug 2025 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Simplepress
Simplepress simplepress
CPEs cpe:2.3:a:simplepress:simplepress:*:*:*:*:*:wordpress:*:*
Vendors & Products Simplepress
Simplepress simplepress

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 01 Mar 2025 04:30:00 +0000

Type Values Removed Values Added
Description The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title Simple:Press <= 6.10.11 - Cross-Site Request Forgery to Unauthorized Post Editing
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Simplepress Simplepress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:49:23.963Z

Reserved: 2025-01-17T18:26:44.327Z

Link: CVE-2024-13518

cve-icon Vulnrichment

Updated: 2025-03-03T16:01:04.699Z

cve-icon NVD

Status : Modified

Published: 2025-03-01T05:15:13.720

Modified: 2026-04-08T18:20:06.387

Link: CVE-2024-13518

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses