CVE-2025-67590

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The Ultimate FAQ plugin (versions up to and including 2.4.3) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.

Risk Assessment

The risk is that an attacker can perform unauthorized actions in the context of an administrator, potentially leading to changes in FAQ settings or data integrity compromise.

Recommendation

Update the Ultimate FAQ plugin to the latest version that includes a fix for the CSRF vulnerability.

Other vulnerabilities in Ultimate FAQ

CVE-2026-94391Medium
Cross Site Scripting (XSS) vulnerability in the Ultimate FAQ plugin in versions up to and including 2.4.14. The vulnerability can be exploited by a user with Contributor privileges.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS