{"id":"CVE-2025-12070","aliases":["EUVD-2025-37623","GHSA-7h4r-7c2q-4767"],"status":"published","title":"ViaAds \u003c= 2.1.2 - Cross-Site Request Forgery to API Key Update","description":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00162,"percentile":0.05429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-11-04T03:26:45Z","modified":"2026-10-19T13:10:00Z","products":[{"vendor":"viaads","product":"viaads"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f65117-e8f7-41d8-bdf4-c1fab03e4792?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/viaads/tags/2.1.1/apikey.php#L81"},{"url":"https://plugins.trac.wordpress.org/changeset/3395777/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12070"},{"url":"https://plugins.trac.wordpress.org/changeset/3395777"},{"url":"https://github.com/advisories/GHSA-7h4r-7c2q-4767"}],"sources":{"cve":[{"id":"CVE-2025-12070","title":"ViaAds \u003c= 2.1.2 - Cross-Site Request Forgery to API Key Update","description":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.","status":"published","published":"2025-11-04T03:26:45.215Z","modified":"2026-04-08T16:32:25.505Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-37623","description":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.","status":"published","published":"2025-11-04T03:26:45Z","modified":"2026-04-08T16:32:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:11.650607Z"}],"ghsa":[{"id":"GHSA-7h4r-7c2q-4767","title":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to...","description":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.","status":"published","published":"2025-11-04T06:31:10Z","modified":"2026-04-08T18:35:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:07:18.583007Z"}],"nvd":[{"id":"CVE-2025-12070","description":"The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.","status":"published","published":"2025-11-04T04:15:37.433Z","modified":"2026-10-19T13:10:00.11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:42.142547Z"}]}}