Description
Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through <= 1.2.0.
Published: 2025-04-01
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to send forged requests to the OwnerRez API, potentially causing unintended actions to be performed on behalf of an authenticated user. The flaw does not directly disclose data but can lead to unauthorized changes or executions within the system. The weakness is identified as CWE‑352.

Affected Systems

The affected product is the OwnerRez API used by WordPress sites. Vulnerable releases are all versions up through and including 1.2.0.

Risk and Exploitability

The issue carries a CVSS score of 4.3, indicating a moderate impact. The EPSS score is below 1 %, suggesting a very low probability of exploitation at present. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would likely rely on tricking a victim into visiting a malicious page while the victim is logged into the WordPress site, sending forged requests to the API endpoint.

Generated by OpenCVE AI on May 1, 2026 at 11:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the OwnerRez plugin to version 1.2.1 or later to eliminate the CSRF flaw.
  • If an upgrade is not immediately possible, configure token‑based CSRF protection on forms that interact with the OwnerRez API.
  • Ensure that authentication cookies used by the plugin are marked as SameSite=Strict or Lax to reduce the chance of cross‑site request forgery.

Generated by OpenCVE AI on May 1, 2026 at 11:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9206 Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez allows Cross Site Request Forgery. This issue affects OwnerRez: from n/a through 1.2.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez allows Cross Site Request Forgery. This issue affects OwnerRez: from n/a through 1.2.0. Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through <= 1.2.0.
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Tue, 01 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Apr 2025 15:00:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez allows Cross Site Request Forgery. This issue affects OwnerRez: from n/a through 1.2.0.
Title WordPress OwnerRez Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:13.471Z

Reserved: 2025-04-01T13:20:24.607Z

Link: CVE-2025-31814

cve-icon Vulnrichment

Updated: 2025-04-01T18:15:02.174Z

cve-icon NVD

Status : Deferred

Published: 2025-04-01T15:16:21.193

Modified: 2026-04-23T15:28:20.880

Link: CVE-2025-31814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T12:00:15Z

Weaknesses