CVE-2025-24713

Vulnerability

Overview

The Button Generator – easily Button Builder plugin for WordPress, versions up to and including 3.1.1, is vulnerable to Cross-Site Request Forgery (CSRF). This flaw allows an attacker to trick a logged-in administrator into performing unwanted actions, such as modifying plugin settings or creating malicious buttons, without their consent [1].

Exploitation

Details

CSRF exploitation requires user interaction: an administrator must click a crafted link or visit a malicious page while authenticated to WordPress. The attacker does not need any special privileges beyond crafting a deceptive request; the administrator's session is used to execute the forged request [1].

Impact

Successful exploitation could lead to unauthorized changes in the plugin's configuration, potentially causing website defacement or redirecting users. The vendor rates this vulnerability as low severity, and mass exploitation may be unlikely but possible in targeted campaigns [1].

Mitigation

The vulnerability is patched in version 3.1.2. Users are strongly advised to update immediately. Plugin auto-updates can be enabled for Patchstack users as a proactive measure [1].