CVE-2025-47519

Root

Cause

The Easy PayPal Events plugin for WordPress versions 1.2.2 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. The lack of CSRF protection means that authenticated requests (such as changing plugin settings or creating events) can be forged without the user's consent [1].

Exploitation

An attacker can exploit this by tricking a logged-in administrator or other privileged user into clicking a malicious link, visiting a crafted page, or submitting a form. No special privileges are required for the attacker beyond the ability to lure a victim [1].

Impact

Successful exploitation allows the attacker to perform unwanted actions under the victim's current authentication, such as modifying event configurations or creating unauthorized PayPal transactions. The vulnerability is rated medium severity (CVSS 4.3) and is noted as being used in mass-exploit campaigns [1].

Mitigation

The vendor has released version 1.3 which remediates the flaw. Users are strongly advised to update immediately. If updating is not possible, consulting a hosting provider or developer is recommended. Patchstack users can enable auto-updates for this plugin [1].