CVE-2025-12358 Overview
CVE-2025-12358 is a Cross-Site Request Forgery [CWE-352] vulnerability in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress. The flaw affects all versions up to and including 4.8.5. The vulnerability stems from missing nonce validation on the post_add_to_list function and an incorrect permissions callback in the Api/init function. Unauthenticated attackers can add or remove products from a victim's wishlist through a forged request, provided the victim clicks a crafted link or visits a malicious page. The scope of impact is limited to wishlist state manipulation and does not affect confidentiality or availability.
Critical Impact
Unauthenticated attackers can manipulate wishlist contents for authenticated WordPress users through forged HTTP requests requiring only user interaction such as clicking a link.
Affected Products
- ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress
- All versions up to and including 4.8.5
- WordPress sites running WooCommerce with ShopEngine wishlist functionality
Discovery Timeline
- 2025-12-03 - CVE-2025-12358 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12358
Vulnerability Analysis
The ShopEngine plugin exposes a wishlist endpoint that mutates server-side state without verifying the origin of the request. Two implementation defects combine to produce the CSRF condition. First, the post_add_to_list function omits WordPress nonce validation, which normally binds a request to an authenticated session. Second, the Api/init function uses an incorrect permissions callback that fails to enforce meaningful authorization checks on incoming requests.
An attacker crafts a request targeting the vulnerable endpoint and delivers it through phishing, malicious advertising, or an attacker-controlled page. When a logged-in WordPress user triggers the request, the browser automatically attaches session cookies. The server processes the wishlist mutation as if the user intentionally initiated it. Successful exploitation results in unauthorized wishlist additions or deletions on behalf of the victim.
Root Cause
The root cause is a failure to implement standard WordPress CSRF protections. WordPress provides wp_verify_nonce() and capability checks specifically to defend against forged cross-origin requests. The vulnerable functions in ShopEngine bypass both controls, treating any request with a valid session cookie as legitimate regardless of origin.
Attack Vector
Exploitation requires user interaction but no authentication on the attacker's side. The attacker hosts a page containing an auto-submitting form or image tag that issues a request to the target WordPress site's wishlist endpoint. When an authenticated ShopEngine user visits the malicious page, their browser transmits the request with session credentials attached. The server-side handler executes the wishlist modification without verifying request authenticity.
The vulnerability mechanism is described in the Wordfence Vulnerability Report and the corresponding fix is documented in the WordPress Plugin Change Log.
Detection Methods for CVE-2025-12358
Indicators of Compromise
- Unexpected wishlist additions or removals reported by end users of the WordPress site
- HTTP POST requests to the ShopEngine wishlist API endpoints with Referer headers pointing to external or unrelated domains
- Requests to post_add_to_list handler paths lacking a valid WordPress nonce parameter
- Spikes in wishlist mutation traffic originating from a narrow set of external referrers
Detection Strategies
- Inspect web server access logs for requests to ShopEngine wishlist endpoints where the Referer header does not match the site's own domain
- Correlate wishlist state changes with user session activity to identify mutations occurring without corresponding on-site browsing behavior
- Deploy a Web Application Firewall rule to flag POST requests to the plugin's REST routes that lack a nonce parameter
Monitoring Recommendations
- Enable WordPress audit logging to record all wishlist state changes with source IP and referrer
- Monitor the ShopEngine plugin's REST API endpoints for anomalous request patterns and cross-origin traffic
- Alert on plugin version drift to detect installations still running 4.8.5 or earlier after remediation windows
How to Mitigate CVE-2025-12358
Immediate Actions Required
- Update the ShopEngine Elementor WooCommerce Builder Addon plugin to the version released after 4.8.5 that includes the fix from changeset 3401226
- Review WordPress user sessions and audit wishlist data for unauthorized modifications following the vulnerability window
- Restrict administrative access to the WordPress dashboard while patching is in progress
Patch Information
The vendor addressed the vulnerability in the commit tracked as changeset 3401226 in the WordPress plugin repository. The fix adds nonce validation to the post_add_to_list function and corrects the permissions callback in the Api/init function. Site administrators should apply the update through the WordPress plugin management interface. Details are available in the WordPress Plugin Change Log.
Workarounds
- Disable the ShopEngine plugin until the patched version is deployed if immediate updating is not possible
- Configure the WordPress site to enforce SameSite=Lax or SameSite=Strict on session cookies to limit cross-origin cookie transmission
- Deploy a WAF rule that blocks requests to ShopEngine wishlist endpoints missing a valid _wpnonce parameter or containing external referrers
# Example WAF rule pattern to block CSRF against ShopEngine wishlist endpoint
SecRule REQUEST_URI "@contains /wp-json/shopengine/" \
"chain,deny,status:403,id:1012358,msg:'ShopEngine CSRF attempt - missing nonce'"
SecRule &ARGS:_wpnonce "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
