CVE-2025-62102

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The WordPress plugin DoFollow Case by Case in versions up to and including 3.5.1 is vulnerable to Cross-Site Request Forgery (CSRF). Missing proper request validation allows an attacker to trick an administrator into performing unauthorized actions on their behalf.

Risk Assessment

An attacker could lure an administrator into clicking a malicious link, causing unwanted operations within the administrator's session. This may lead to configuration changes or other unauthorized actions on the site.

Recommendation

Update the DoFollow Case by Case plugin to a version newer than 3.5.1 as soon as it becomes available. Until then, restrict admin panel access and educate administrators about clicking unknown links.

Other vulnerabilities in DoFollow Case by Case

CVE-2026-95817High
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.6.0 due to insufficient input sanitization and output escaping. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS