PT-2025-34189 · WordPress · Inspiro

Dmitry Ignatyev · Published 2025-08-21 · Updated 2025-09-15 · CVE-2025-8592

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Inspiro theme for WordPress versions prior to 2.1.3

Description: The Inspiro theme for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the inspiro install plugin() function. This allows unauthenticated attackers to install plugins from the repository by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations: Update the Inspiro theme to version 2.1.3 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-8592

Affected Products

Inspiro

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-8592 · Security Note
• https://t.me/pentestingnews/66768 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/20f461d1-aeb2-4913-804c-6a081e48765a?source=cve · Note
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=284043%40inspiro%2F2.1.3&old=282419%40inspiro%2F2.1.2 · Note
• https://twitter.com/TweetThreatNews/status/1958843783509930371 · Twitter Post
• https://t.me/CVEtracker/30564 · Telegram Post
• https://twitter.com/compuchris/status/1958992073031356561 · Twitter Post
• https://twitter.com/DavidMarquet19/status/1967483547075195191 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958499205959303177 · Twitter Post
• https://twitter.com/cracbot/status/1960296218505977944 · Twitter Post
• https://t.me/cveNotify/132984 · Telegram Post
• https://research.cleantalk.org/cve-2025-8592 · Note
• https://twitter.com/BaseFortify/status/1958442762035945552 · Twitter Post
• https://themes.trac.wordpress.org/ticket/228813 · Note
• https://themes.trac.wordpress.org/browser/inspiro/2.1.1/inc/admin/pluginInstaller/class-inspiro-plugin-installer.php#L67 · Note