CVE-2025-48362

MediumCVSS 5.4

Published: 28/08/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Hesabfa Accounting plugin (hesabfa-accounting) in versions up to and including 2.2.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions on behalf of a logged-in user.

Risk Assessment

An attacker could trick an administrator into performing unwanted operations in WordPress, potentially leading to configuration changes or site takeover.

Recommendation

Update the Hesabfa Accounting plugin to a version newer than 2.2.5, or remove it if not in use.

Other vulnerabilities in Hesabfa Accounting

CVE-2025-48361Medium
The Hesabfa Accounting plugin for WordPress (versions up to and including 2.2.5) contains an Insertion of Sensitive Information Into Sent Data vulnerability, allowing retrieval of embedded sensitive data.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through <= 2.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS