PT-2025-47739 · WordPress · Rafflepress

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-66064

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions RafflePress versions through 1.12.20

Description A Cross-Site Request Forgery (CSRF) issue exists in RafflePress. This allows an attacker to perform actions on behalf of an authenticated user without their knowledge. The issue impacts the Giveaways and Contests by RafflePress component.

Recommendations Update RafflePress to a version later than 1.12.20.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-66064

Affected Products

Rafflepress

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-66064 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1991856006671040790 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note