CVE-2025-32241

Cross-Site Request Forgery (CSRF) vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.This issue affects Official CleverReach Plugin for WooCommerce: from n/a through <= 3.4.6.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://patchstack.com/database/Wordpress/Plugin/cleverreach-wc/vulnerability/wordpress-official-cleverreach-woocommerce-integration-plugin-3-4-3-csrf-to-settings-change-vulnerability?_s_id=cve

Configurations

No configuration.

History

No history.

Information

Published : 2025-04-04 16:15

Updated : 2026-06-17 09:11

NVD link : CVE-2025-32241

Mitre link : CVE-2025-32241

CVE.ORG link : CVE-2025-32241

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-32241", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-32241", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-04T19:38:21.266502Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "CleverReach\u00ae", "product": "Official CleverReach Plugin for WooCommerce", "versions": [{"status": "affected", "changes": [{"at": "3.4.7", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.4.6"}], "packageName": "cleverreach-wc", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}]}], "published": "2025-04-04T16:15:33.530", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/cleverreach-wc/vulnerability/wordpress-official-cleverreach-woocommerce-integration-plugin-3-4-3-csrf-to-settings-change-vulnerability?_s_id=cve", "source": "audit@patchstack.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in CleverReach\u00ae Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.This issue affects Official CleverReach Plugin for WooCommerce: from n/a through <= 3.4.6."}, {"lang": "es", "value": "La vulnerabilidad de Cross Site Request Forgery (CSRF) en CleverReach\u00ae Official CleverReach Plugin for WooCommerce permite Cross Site Request Forgery. Este problema afecta al plugin oficial de CleverReach para WooCommerce desde la versi\u00f3n n/d hasta la 3.4.3."}], "lastModified": "2026-06-17T09:11:40.283", "sourceIdentifier": "audit@patchstack.com"}