CVE-2025-26577
Published: 13 February 2025
Summary
CVE-2025-26577 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26577 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the daxiawp DX-auto-publish WordPress plugin (also referred to as dx-auto-publish). This flaw enables Stored XSS and affects all versions from n/a through 1.2 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this over the network by crafting a malicious webpage or resource that tricks an authenticated user into performing a state-changing action via CSRF, such as submitting a form that injects a Stored XSS payload. Upon successful exploitation, the attacker achieves Stored XSS execution in the context of the victim's browser, potentially leading to session hijacking, data theft, or further site compromise within the plugin's scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/dx-auto-publish/vulnerability/wordpress-dx-auto-publish-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve documents this CSRF-to-Stored XSS issue specifically in DX-auto-publish version 1.2 for WordPress, providing details on the vulnerability for mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4230
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin directly enables T1190 Exploit Public-Facing Application; resulting Stored XSS facilitates T1185 Browser Session Hijacking for session theft or further compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthorized state-changing actions tricked via malicious webpages in this CSRF vulnerability.
Validates and sanitizes inputs to block malicious Stored XSS payloads from being accepted and stored through the CSRF exploit.
Filters information outputs to neutralize any Stored XSS payloads injected via the CSRF vulnerability before rendering in users' browsers.