CVE-2025-67598: WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67598?
CVE-2025-67598 is classified as a high severity vulnerability due to its ability to allow unauthorized actions via Cross-Site Request Forgery.
How do I fix CVE-2025-67598?
To remediate CVE-2025-67598, upgrade SupportCandy to version 3.4.2 or later, which addresses the CSRF vulnerability.
What software is affected by CVE-2025-67598?
CVE-2025-67598 affects SupportCandy versions from an unspecified version to 3.4.1.
How can CVE-2025-67598 impact my website?
CVE-2025-67598 can impact your website by allowing attackers to perform actions on behalf of authenticated users without their consent.
Is CVE-2025-67598 being actively exploited?
As of the last update, there is no public indication that CVE-2025-67598 is being actively exploited, but it remains critical to apply the necessary fixes.