CVE-2025-0801
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Feb 28, 2025
Updated: Mar 6, 2025
CWE ID 352
Summary
CVE-2025-0801 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the RateMyAgent Official plugin for WordPress. Versions up to and including 1.4.0 are at risk. This issue arises from insufficient or missing nonce validation on the 'rma-settings-wizard'. Consequently, unauthenticated attackers can manipulate site administrators into executing a malicious request, enabling them to update the plugin's API key. This poses a severe threat, allowing unauthorized access and potential misuse of the plugin's functionality.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.