CVE-2025-31602

WordPress Apimo Connector plugin <= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Published Mar 31, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.

Analysis

Technical impact

The vulnerability is a CSRF flaw affecting the Apimo Connector plugin for WordPress. It allows attackers who can trick a logged‑in user into visiting a crafted URL to cause the server to change plugin settings without the user's consent. This weakness is categorized as CWE‑352 and can lead to unauthorized changes affecting site configuration and potentially site functionality.

Affected Systems

The issue is present in all versions of the Apimo Connector up to and including 2.6.5.1 deployed by the Proptech Plugin vendor. No specific sub‑version range beyond the latest publicly available is listed, so any installation of 2.6.5.1 or older is considered vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present, and the vulnerability is not part of the CISA KEV catalog. Likely exploited through a web request originating from a victim’s browser session; an attacker would need to lure the victim to a malicious link or form that triggers the setting change request. While it does not grant remote code execution, the ability to alter settings can undermine site integrity and trust.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Proptech Plugin

Apimo Connector

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.6.5.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Apimo Connector plugin to a version newer than 2.6.5.1 that incorporates the CSRF protection fix.
If an update is not immediately possible, de‑activate or remove the plugin from the WordPress installation to prevent any CSRF exploitation.
For sites that must keep the plugin active, enforce stricter CSRF token validation on all actions that alter configuration, or restrict sensitive changes to a secure administrative interface only accessible over HTTPS.

Generated by OpenCVE AI on May 1, 2026 at 02:53 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-8804	Cross-Site Request Forgery (CSRF) vulnerability in apimofficiel Apimo Connector allows Cross Site Request Forgery. This issue affects Apimo Connector: from n/a through 2.6.3.1.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.147% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/apimo/vulnerability/wordpress-apimo-connector-plugin-2-6-3-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve

History

Apr 28, 2026 6:30 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.	Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.
Title	WordPress Apimo Connector plugin <= 2.6.5.2 - Cross Site Request Forgery (CSRF) vulnerability	WordPress Apimo Connector plugin <= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Apr 23, 2026 3:00 PM Description updated. Title updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.	Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
Title	WordPress Apimo Connector plugin <= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerability	WordPress Apimo Connector plugin <= 2.6.5.2 - Cross Site Request Forgery (CSRF) vulnerability
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in apimofficiel Apimo Connector allows Cross Site Request Forgery. This issue affects Apimo Connector: from n/a through 2.6.3.1.	Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.
Title	WordPress Apimo Connector plugin <= 2.6.3.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	WordPress Apimo Connector plugin <= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerability
References	https://patchstack.com/database/wordpress/plugin/apimo/vulnerability/wordpress-apimo-connector-plugin-2-6-3-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/apimo/vulnerability/wordpress-apimo-connector-plugin-2-6-3-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

Mar 31, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 31, 2025 1:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in apimofficiel Apimo Connector allows Cross Site Request Forgery. This issue affects Apimo Connector: from n/a through 2.6.3.1.
Title		WordPress Apimo Connector plugin <= 2.6.3.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/wordpress/plugin/apimo/vulnerability/wordpress-apimo-connector-plugin-2-6-3-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`