PT-2025-47254 · WordPress · Wp Admin Microblog

Nabil Irawan · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12173

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Admin Microblog plugin for WordPress versions prior to 3.1.2

Description The WP Admin Microblog plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of, or incorrect, nonce validation on the 'wp-admin-microblog' page. An unauthenticated attacker could potentially send messages as an administrator if they can trick an administrator into performing an action, such as clicking a malicious link.

Recommendations Update the WP Admin Microblog plugin to version 3.1.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12173

Affected Products

Wp Admin Microblog

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-12173 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9c26a76d-a104-4ea6-be9f-9e8dfc3b5cd5?source=cve · Note
• https://wordpress.org/plugins/wp-admin-microblog · Note
• https://twitter.com/CVEnew/status/1990703893546995774 · Twitter Post