Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-31751: Breaking News WP can be tricked into unwanted actions

CVE-2025-31751 · published 1 year ago

Summary

The Breaking News WP plugin lets a malicious website cause a logged‑in user to perform actions they did not intend, such as changing settings or publishing content. This could let an attacker manipulate your site without proper permission. Update the plugin to the latest version or apply the vendor's recommended fix, and consider adding additional verification steps for sensitive actions.

Original advisory text

Cross-Site Request Forgery (CSRF) vulnerability in doit Breaking News WP breaking-news-wp allows Cross Site Request Forgery.This issue affects Breaking News WP: from n/a through <= 1.3.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published1 Apr 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-31751 · NVD

Track software like this

Free during beta