CVE-2025-22814
Published: 09 January 2025
Summary
CVE-2025-22814 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 mandates session authenticity mechanisms such as anti-CSRF tokens, directly preventing forged requests that exploit this CSRF vulnerability in the WordPress plugin.
SI-2 requires timely identification, reporting, and correction of system flaws, directly addressing the need to patch the vulnerable Zephyr Admin Theme plugin up to version 1.4.1.
SI-10 enforces validation of information inputs, mitigating the stored XSS payload that results from successful CSRF exploitation in this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in a public-facing WordPress plugin directly enables remote exploitation of a web application (T1190).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.
Deeper analysisAI
CVE-2025-22814 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Zephyr Modern Admin Theme (zephyr-modern-admin-theme) WordPress plugin developed by Dylan James. The issue affects all versions of the plugin up to and including 1.4.1, enabling attackers to perform unauthorized actions on behalf of authenticated users.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited remotely by unauthenticated attackers with low complexity. Exploitation requires user interaction, typically tricking an authenticated administrator into visiting a malicious webpage or clicking a forged link, which submits unauthorized requests and results in low impacts to confidentiality, integrity, and availability, with a changed scope.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/zephyr-modern-admin-theme/vulnerability/wordpress-zephyr-admin-theme-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve) describes this as a CSRF-to-stored XSS vulnerability in version 1.4.1 and provides details on mitigation, which security practitioners should consult for patching or workaround guidance.
Details
- CWE(s)