PT-2025-40509 · WordPress · Ap Background

Nabil Irawan · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-9897

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AP Background plugin for WordPress versions up to and including 3.8.2

Description The software is susceptible to Cross-Site Request Forgery (CSRF). This is due to missing or incorrect nonce validation within the advParallaxBackAdminSaveSlider function. An unauthenticated attacker may be able to create or modify background sliders by forging a request, provided they can trick a site administrator into performing an action.

Recommendations Update the AP Background plugin to a version newer than 3.8.2.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9897

Affected Products

Ap Background

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9897 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php#L135 · Note
• https://twitter.com/CVEnew/status/1974076241448693924 · Twitter Post
• https://t.me/CVEtracker/34013 · Telegram Post