CVE-2025-25101
Published: 07 February 2025
Summary
CVE-2025-25101 is a critical-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires protections for session authenticity, directly preventing CSRF attacks that exploit valid user sessions with forged requests.
SI-10 enforces validation of information inputs such as CSRF tokens, blocking forged requests lacking proper validation in the vulnerable plugin.
SI-2 mandates identification and correction of flaws like the CSRF vulnerability in Munk Sites through timely patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin enables exploitation via malicious link to achieve arbitrary plugin installation.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.
Deeper analysisAI
CVE-2025-25101 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Munk Sites WordPress plugin by MetricThemes. Published on 2025-02-07, it affects all versions of the plugin from n/a through 1.0.7. The vulnerability enables CSRF attacks due to insufficient protections in the plugin's request handling.
With a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), the issue allows unauthenticated remote attackers to exploit it with low complexity by tricking authenticated users—typically administrators—into interacting with a malicious webpage, such as clicking a forged link. Successful exploitation leads to arbitrary plugin installation on the target WordPress site, granting high impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/munk-sites/vulnerability/wordpress-munk-sites-plugin-1-0-7-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve provides details on this CSRF-to-arbitrary-plugin-installation vulnerability in Munk Sites version 1.0.7, including mitigation guidance for affected WordPress installations.
Details
- CWE(s)