CVE-2025-23640
Published: 16 January 2025
Summary
CVE-2025-23640 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23640 is a Cross-Site Request Forgery (CSRF) vulnerability in the Rename Author Slug WordPress plugin by Nazmul Ahsan, which enables Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from its initial release through 1.2.0. Published on 2025-01-16, it is associated with CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers can exploit the vulnerability remotely with low attack complexity by tricking users into submitting malicious requests through CSRF. This requires user interaction but no privileges from the attacker. Exploitation results in stored XSS, allowing limited impacts on confidentiality, integrity, and availability within a changed security scope.
The Patchstack advisory provides further details on the vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/rename-author-slug/vulnerability/wordpress-rename-author-slug-plugin-1-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3304
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan Rename Author Slug rename-author-slug allows Stored XSS.This issue affects Rename Author Slug: from n/a through <= 1.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of T1190 (Exploit Public-Facing Application) for remote unauthenticated access; the resulting stored XSS facilitates T1059.007 (JavaScript) by allowing arbitrary client-side script execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing unauthenticated attackers from forging requests to store XSS payloads in the Rename Author Slug plugin.
SI-10 requires validation of all inputs, blocking malicious XSS payloads delivered via CSRF from being processed and stored by the vulnerable plugin.
SI-15 filters outputs to prevent execution of any stored XSS payloads resulting from successful CSRF exploitation in the plugin.