PT-2025-20151 · Iqonic Design · Iqonic Design Graphina

Timomangcut · Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-47533

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Iqonic Design Graphina versions 3.0.4 and earlier

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows PHP Local File Inclusion. This means an attacker could potentially trick a user into performing unintended actions on the web application, which could lead to the inclusion of local files, potentially revealing sensitive information.

Recommendations For Iqonic Design Graphina versions 3.0.4 and earlier, as a temporary workaround, consider implementing CSRF token validation to prevent unauthorized requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-47533

Affected Products

Iqonic Design Graphina

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-47533 · Security Note
• https://twitter.com/CVEnew/status/1920130563819831458 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-0-4-cross-site-request-forgery-csrf-to-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-0-4-cross-site-request-forgery-csrf-to-local-file-inclusion-vulnerability?_s_id=cve · Note