CVE-2025-23822
Published: 16 January 2025
Summary
CVE-2025-23822 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23822 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Category Custom Fields (categorycustomfields) developed by alicornea. This issue affects all versions from n/a through 1.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this CSRF vulnerability over the network by tricking an authenticated user into submitting a malicious request, such as through a crafted webpage or link that the user interacts with. Exploitation requires user interaction but no special privileges, enabling the attacker to perform unauthorized actions on behalf of the victim within the plugin's functionality, potentially leading to low-level impacts on confidentiality, integrity, and availability due to the changed scope.
The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/categorycustomfields/vulnerability/wordpress-category-custom-fields-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3452
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in alicornea Category Custom Fields categorycustomfields allows Cross Site Request Forgery.This issue affects Category Custom Fields: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the application (T1190); the stored XSS component facilitates injection and execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CSRF by requiring session authenticity mechanisms such as tokens or cookies to validate that requests originate from legitimate user sessions.
Addresses the specific CSRF flaw in the Category Custom Fields WordPress plugin through timely identification, reporting, and patching to vendor-fixed versions.
Validates request inputs, including CSRF tokens and parameters, to reject forged requests that lack proper validation tokens.