CVE-2025-23820
Published: 16 January 2025
Summary
CVE-2025-23820 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23820 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Content Security Policy Pro WordPress plugin developed by thapa.laxman. The flaw affects all versions of the plugin from n/a through 1.3.5 inclusive. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.
Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) by tricking authenticated users into performing unintended actions via malicious websites or links, as user interaction is required (UI:R). Successful exploitation enables low-level impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) within a changed scope (S:C), allowing forged requests to manipulate plugin functionality.
The Patchstack advisory provides further details on this CSRF issue in the Content Security Policy Pro plugin at https://patchstack.com/database/Wordpress/Plugin/content-security-policy-pro/vulnerability/wordpress-content-security-policy-pro-plugin-1-3-5-csrf-to-stored-xss-vulnerability?_s_id=cve, including recommended mitigations such as updating to a version beyond 1.3.5.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3450
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in thapa.laxman Content Security Policy Pro content-security-policy-pro allows Cross Site Request Forgery.This issue affects Content Security Policy Pro: from n/a through <= 1.3.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of the application (T1190) and leads to stored XSS facilitating arbitrary JavaScript execution (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect session authenticity, directly mitigating the CSRF vulnerability by ensuring forged requests from malicious sites cannot impersonate legitimate user actions in the Content Security Policy Pro plugin.
SI-10 mandates validation of information inputs, including CSRF tokens, to block unauthorized state-changing requests exploiting this plugin's CSRF flaw.
SI-2 ensures timely flaw remediation, directly addressing this CVE by patching the Content Security Policy Pro plugin to versions beyond 1.3.5.