Medium · 5.4 CVE-2025-31457 EUVD-2025-8598GHSA-4h29-vm8p-m838

WordPress LWS SMS plugin <= 2.4.1 - Cross Site Request Forgery (CSRF) Vulnerability

Published Mar 28, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through <= 2.4.1.

Affected products

Vendor	Product	Affected	Fixed
Aurélien LWS	LWS SMS	≤ 2.4.1	—

References

https://patchstack.com/database/Wordpress/Plugin/lws-sms/vulnerability/wordpress-lws-sms-2-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry