CVE-2025-48362

The Hesabfa Accounting plugin for WordPress versions up to 2.2.5 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw arises from missing or insufficient CSRF token validation, enabling an attacker to trick authenticated users into performing unintended actions [1].

Exploitation requires user interaction: a privileged user must click a malicious link, visit a crafted page, or submit a form. No authentication is needed for the attacker, but the victim must be logged in to the WordPress admin panel [1].

A successful CSRF attack can force the victim to execute arbitrary actions within the plugin's administrative functions, such as modifying settings, creating new users, or performing financial transactions without their consent. This could lead to data manipulation or privilege escalation [1].

The vulnerability affects all versions up to and including 2.2.5. It has been patched in a newer version; users are strongly advised to update the plugin immediately. If an update is not possible, consider implementing additional CSRF protections or using a web application firewall [1].