CVE-2025-60117

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

CSRF vulnerability in the Vehica Core. An attacker can exploit this to perform unauthorized actions in the admin panel.

Risk Assessment

Risk of unauthorized modification of theme data or configuration, potentially leading to site takeover.

Recommendation

Update Vehica Core to the latest version. Implement CSRF protection in forms and requests.

Other vulnerabilities in Vehica Core

CVE-2026-66654Medium
Subscriber-level Server Side Request Forgery (SSRF) vulnerability in Vehica Core plugin versions up to and including 1.0.104.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS