PT-2025-44919 · WordPress · Viaads Plugin

Nabil Irawan · Published 2025-11-04 · Updated 2025-11-04 · CVE-2025-12070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ViaAds plugin for WordPress versions prior to 2.1.2

Description The ViaAds plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) in versions up to and including 2.1.1. The issue stems from the absence of nonce validation within the ViaAds pluginHandler function. This allows unauthenticated attackers to potentially alter the plugin’s API key and cookie consent settings by crafting a malicious request and deceiving an administrator into executing it, such as clicking a specially designed link.

Recommendations Update the ViaAds plugin to version 2.1.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12070

Affected Products

Viaads Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12070 · Security Note
• https://t.me/CVEtracker/36475 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3395777 · Note
• https://plugins.trac.wordpress.org/browser/viaads/tags/2.1.1/apikey.php#L81 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/00f65117-e8f7-41d8-bdf4-c1fab03e4792?source=cve · Note
• https://t.me/cveNotify/141483 · Telegram Post