Description
Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.
Published: 2025-06-06
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a CSRF flaw that allows an attacker to elevate a user’s privileges to administrator level by forging state‑changing requests to the WP‑Recall plugin. The flaw arises from improper nonce verification, letting an unauthenticated request alter the user’s role. This is a classic CWE‑352 issue.

Affected Systems

WP‑Recall plugin from any released version up to and including 16.26.14, released by tggfref.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score of < 1% shows a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a CSRF attack via a crafted link or form, requiring the victim to visit a malicious webpage while authenticated to the WordPress site.

Generated by OpenCVE AI on April 30, 2026 at 18:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update WP‑Recall to version 16.26.15 or later, which removes the CSRF flaw.
  • If an upgrade is not immediately possible, disable the plugin or restrict its use to non‑admin roles until a patch is applied.
  • Ensure that all state‑changing URLs and forms in the site include a unique nonce or CSRF token to prevent unauthorized requests.

Generated by OpenCVE AI on April 30, 2026 at 18:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-17230 Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.
History

Tue, 28 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 28 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall wp-recall allows Privilege Escalation.This issue affects WP-Recall: from n/a through <= 16.26.14. Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.
References

Thu, 23 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14. Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall wp-recall allows Privilege Escalation.This issue affects WP-Recall: from n/a through <= 16.26.14.
References

Fri, 06 Jun 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Jun 2025 13:15:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.
Title WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:02.886Z

Reserved: 2025-03-26T09:22:34.906Z

Link: CVE-2025-30981

cve-icon Vulnrichment

Updated: 2025-06-06T16:10:55.862Z

cve-icon NVD

Status : Deferred

Published: 2025-06-06T13:15:37.903

Modified: 2026-04-28T19:30:51.767

Link: CVE-2025-30981

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T18:30:16Z

Weaknesses