CVE-2025-22557
Published: 07 January 2025
Summary
CVE-2025-22557 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22557 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the cdowp News Publisher Autopilot WordPress plugin (wpm-news-api). This issue affects all versions from n/a through 2.1.4. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its network reachability, low complexity, lack of prerequisite privileges, requirement for user interaction, and elevated scope with low impacts across confidentiality, integrity, and availability.
Attackers can exploit this CSRF flaw without authentication by crafting malicious web pages, emails, or links that trick authenticated users into submitting unintended requests to the plugin. User interaction, such as visiting a malicious site, is required to trigger the forgery. Exploitation enables limited unauthorized access or modifications, leveraging the changed scope to affect the plugin's operations with low-level disruptions to data confidentiality, integrity, and availability.
The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/wpm-news-api/vulnerability/wordpress-news-publisher-autopilot-plugin-2-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve) describes this as a CSRF-to-Stored XSS vulnerability in the News Publisher Autopilot plugin up to version 2.1.4. Security practitioners should consult the advisory for detailed mitigation guidance, including any available patches or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2835
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored-XSS in public-facing WordPress plugin directly enables exploitation of a web application vulnerability (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect session authenticity, such as anti-CSRF tokens, directly preventing forged requests that exploit this CSRF vulnerability in the WordPress plugin.
SI-10 mandates validation of information inputs, including CSRF tokens, to reject unauthorized forged requests targeting the vulnerable plugin endpoint.
SI-2 ensures timely identification, reporting, and remediation of system flaws like this specific CVE by patching the affected News Publisher Autopilot plugin versions.