CVE-2025-1463: Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish
Description
The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary posts, including private, granted they can trick a site administrator into performing an action such as clicking on a link.
Classification
CVE ID: CVE-2025-1463
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Problem Types
CWE-352 Cross-Site Request Forgery (CSRF)Affected Products
Vendor: javmah
Product: Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table.
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.01% (probability of being exploited)
EPSS Percentile: 1.27% (scored less or equal to compared to others)
EPSS Date: 2025-04-02 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-1463https://www.wordfence.com/threat-intel/vulnerabilities/id/034ba83f-4ee3-40f1-a41a-8b3d0055a1ba?source=cve
https://wordpress.org/plugins/wpgsi/#developers
https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-show.php
https://plugins.trac.wordpress.org/changeset/3250077/#file352
https://plugins.trac.wordpress.org/changeset/3250077/