CVE-2025-23815
Published: 16 January 2025
Summary
CVE-2025-23815 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23815 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the linickx root Cookie WordPress plugin. It affects all versions from n/a through 1.6. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its network accessibility, low complexity, lack of required privileges, and potential for changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this CSRF flaw without authentication by tricking a user into submitting a malicious request via a crafted webpage or link, requiring user interaction such as clicking. This enables unauthorized actions on sites running the vulnerable plugin, potentially leading to outcomes like stored XSS as indicated in vulnerability details.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/root-cookie/vulnerability/wordpress-root-cookie-plugin-1-6-csrf-to-stored-xss-vulnerability?_s_id=cve documents this as a CSRF-to-stored XSS issue in the WordPress Root Cookie plugin version 1.6, offering insights for practitioners on detection and remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3445
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in linickx root Cookie allows Cross Site Request Forgery. This issue affects root Cookie: from n/a through 1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in a public-facing WordPress plugin directly maps to exploitation of public-facing applications (T1190). The resulting stored XSS enables arbitrary JavaScript execution in the browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms such as synchronizer tokens or origin checks, directly preventing CSRF exploitation in the vulnerable WordPress plugin.
SI-10 requires validation of information inputs including anti-CSRF tokens and referer headers, blocking forged requests that lead to stored XSS via this CSRF vulnerability.
SI-2 mandates timely flaw remediation, directly addressing the CSRF-to-stored XSS vulnerability by patching the linickx root Cookie plugin.