CVE-2025-22571
Published: 07 January 2025
Summary
CVE-2025-22571 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22571 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Instabot WordPress plugin. It affects all versions from n/a through 1.10 inclusive. The issue enables CSRF attacks, carrying a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, required user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this over the network by tricking a victim—typically an authenticated user such as an administrator—into performing unintended actions via a malicious webpage or link. Exploitation requires user interaction but can lead to consequences like stored cross-site scripting (XSS), as indicated in related advisories, allowing limited disruption or data exposure with broader scope due to the plugin's context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/instabot/vulnerability/wordpress-instabot-plugin-1-10-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on this CSRF-to-stored-XSS issue in the WordPress Instabot plugin version 1.10, including recommended mitigations such as updating to a patched version where available or implementing CSRF protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2847
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exploitation of a public-facing WordPress plugin vulnerability via network-accessible CSRF leading to stored XSS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 directly mitigates CSRF by requiring session authenticity mechanisms like anti-CSRF tokens to validate state-changing requests in the Instabot plugin.
SI-2 addresses the vulnerability by requiring timely identification, reporting, and remediation of the CSRF flaw in Instabot versions through 1.10, such as patching or removal.
SI-10 partially mitigates CSRF by validating inputs like origin headers or tokens to reject forged requests exploiting the Instabot plugin.