CVE-2025-62880

MediumCVSS 4.3

Published: 22/12/2025(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The WordPress plugin Custom 404 Pro (custom-404-pro) in versions up to and including 3.12.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability allows unauthorized actions to be performed in the context of a logged-in user.

Risk Assessment

An attacker could trick an administrator into unknowingly performing actions in the WordPress admin panel, potentially leading to unwanted changes in site configuration.

Recommendation

Update the Custom 404 Pro plugin to a version later than 3.12.0 or disable it if no fix is available.

Other vulnerabilities in Custom 404 Pro

CVE-2025-9947Medium
The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'path' parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS