CVE-2025-22347: BSK Forms Blacklist CSRF Vulnerability

CVE-2025-22347 Overview

CVE-2025-22347 is a Cross-Site Request Forgery (CSRF) vulnerability in the bannersky BSK Forms Blacklist plugin for WordPress that chains into a blind SQL injection. The flaw affects the bsk-gravityforms-blacklist plugin from unspecified earlier versions through 3.9. Attackers exploit the missing CSRF protections [CWE-352] to coerce authenticated administrators into submitting forged requests. These requests inject attacker-controlled SQL payloads into backend database queries. Successful exploitation enables data exfiltration and limited database tampering without direct authentication to the WordPress instance.

Critical Impact
An attacker can trick a logged-in administrator into visiting a malicious page, triggering blind SQL injection against the WordPress database with high confidentiality impact.

Affected Products

bannersky BSK Forms Blacklist (bsk-gravityforms-blacklist) WordPress plugin
All versions up to and including 3.9
WordPress sites running Gravity Forms with the BSK Forms Blacklist integration

Discovery Timeline

2025-01-07 - CVE-2025-22347 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22347

Vulnerability Analysis

The vulnerability combines two weaknesses in the BSK Forms Blacklist plugin. First, plugin request handlers lack anti-CSRF nonce validation, allowing unauthenticated remote attackers to forge state-changing requests. Second, downstream code passes user-supplied input into SQL queries without proper sanitization or parameterization, producing a blind SQL injection sink. The attack requires user interaction in the form of an authenticated administrator visiting an attacker-controlled page. Because the injection is blind, attackers infer data through boolean conditions or time-based payloads rather than direct response content.

Root Cause

The root cause is missing CSRF token verification on privileged plugin endpoints, as classified by [CWE-352]. The plugin does not call WordPress functions such as wp_verify_nonce() or check_admin_referer() before processing requests that interact with the database. Combined with unsanitized parameter handling in SQL construction, this produces an exploitable chain.

Attack Vector

The attack vector is network-based and requires victim interaction. An attacker hosts a malicious page or sends a crafted link containing an HTML form or JavaScript that auto-submits to the vulnerable plugin endpoint on the target WordPress site. When an authenticated administrator loads the page, the browser sends the forged request along with valid session cookies. The plugin processes the request and executes the embedded SQL payload against the database. The attacker observes timing or behavioral side channels to extract data row by row.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-22347

Indicators of Compromise

Unexpected outbound POST or GET requests to bsk-gravityforms-blacklist plugin endpoints originating from administrator browsers
Web server access logs showing requests to plugin URLs with SQL syntax patterns such as SLEEP(, BENCHMARK(, UNION SELECT, or boolean conditions like AND 1=1
HTTP referer headers pointing to external, untrusted domains immediately preceding plugin requests
Database query logs with unusually long execution times consistent with time-based blind SQL injection

Detection Strategies

Inspect WordPress access logs for POST requests to plugin paths lacking a valid _wpnonce parameter
Deploy web application firewall rules that flag SQL metacharacters in plugin request parameters
Correlate administrator authentication sessions with anomalous request bursts to plugin endpoints

Monitoring Recommendations

Enable WordPress audit logging for all plugin administrative actions and database modifications
Monitor wp_options and plugin-managed tables for unexpected writes or schema changes
Alert on cross-origin referers reaching authenticated WordPress admin endpoints

How to Mitigate CVE-2025-22347

Immediate Actions Required

Disable or remove the BSK Forms Blacklist plugin until a vendor-supplied patched version above 3.9 is installed
Force administrator session re-authentication and rotate all WordPress admin credentials
Audit the database for unauthorized records, modified options, and unknown administrator accounts

Patch Information

No patched version is referenced in the available CVE data beyond the affected range of versions through 3.9. Site operators should consult the Patchstack Vulnerability Advisory and the WordPress plugin repository for current update availability. Apply the vendor fix as soon as it is published.

Workarounds

Restrict access to /wp-admin/ paths by source IP using web server or firewall rules
Deploy a web application firewall with CSRF and SQL injection rule sets in front of the WordPress instance
Instruct administrators to log out of WordPress when not actively performing admin tasks and avoid browsing untrusted sites in the same browser session

bash

# Example nginx restriction limiting BSK plugin endpoints to trusted admin IPs
location ~* /wp-content/plugins/bsk-gravityforms-blacklist/ {
    allow 203.0.113.0/24;
    deny all;
}