CVE-2025-68529

MediumCVSS 4.3

Published: 24/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

CSRF vulnerability in WP Email Capture up to version 3.12.5. Allows an attacker to perform unauthorized actions in the context of a logged-in user.

Risk Assessment

Risk of unauthorized changes to email capture configuration, potentially leading to data integrity compromise.

Recommendation

Update the plugin to the latest version if available and implement CSRF protections.

Other vulnerabilities in WP Email Capture

CVE-2025-67578Medium
The WP Email Capture plugin (by Rhys Wynne) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WP Email Capture from n/a through <= 3.12.4.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS