PT-2025-54377 · Mergado · Mergado Pack

Muhammad Nur Ibnu Hubab · CVE-2025-62089 · Published 2025-12-31 · Updated 2025-12-31

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mergado Pack versions through 4.2.0

Description A Cross-Site Request Forgery (CSRF) issue exists in MERGADO Mergado Pack. This allows attackers to perform actions on behalf of authenticated users without their knowledge. The issue affects the application by potentially allowing unauthorized command execution.

Recommendations Update Mergado Pack to a version later than 4.2.0.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-62089

Affected Products

Mergado Pack

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-62089 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/mergado-marketing-pack/vulnerability/wordpress-mergado-pack-plugin-4-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2006495446387105858 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/mergado-marketing-pack/vulnerability/wordpress-mergado-pack-plugin-4-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/41088 · Telegram Post
• https://vdp.patchstack.com/database/wordpress/plugin/mergado-marketing-pack/vulnerability/wordpress-mergado-pack-plugin-4-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note