CVE-2025-24546: Ultimate Coming Soon & Maintenance CSRF

CVE-2025-24546 Overview

CVE-2025-24546 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the RSTheme Ultimate Coming Soon & Maintenance WordPress plugin. The flaw impacts all versions up to and including 1.0.9. The weakness is categorized under [CWE-352] and allows an attacker to trick an authenticated user into submitting unintended state-changing requests to the affected site.

Exploitation requires user interaction, typically by luring a logged-in administrator to a malicious page. The vulnerability can result in limited integrity and availability impact on the target WordPress instance.

Critical Impact
Attackers can leverage a victim's authenticated session to perform unauthorized plugin actions on WordPress sites running Ultimate Coming Soon & Maintenance <= 1.0.9.

Affected Products

RSTheme Ultimate Coming Soon & Maintenance plugin for WordPress
All versions from n/a through 1.0.9
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-24 - CVE-2025-24546 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24546

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented anti-CSRF protections in the Ultimate Coming Soon & Maintenance plugin. State-changing requests handled by the plugin do not sufficiently verify that the request originated from a legitimate user action. This allows an attacker-controlled page to submit forged requests using a victim's authenticated browser session.

The EPSS score for this issue is 0.202% with a percentile of 10.279, indicating a low likelihood of active exploitation at scale. However, targeted attacks against site administrators remain feasible where the plugin is installed.

Root Cause

The root cause is the absence of proper CSRF token validation, such as WordPress wp_nonce_field() and check_admin_referer() checks, on privileged plugin endpoints. Without a request-bound nonce, the server cannot distinguish between a legitimate administrator action and a forged cross-origin request that reuses the victim's session cookies.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a malicious HTML page containing a hidden form or JavaScript that targets a vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator visits the page, the browser automatically sends session cookies with the forged request, and the plugin executes the requested action.

See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-24546

Indicators of Compromise

Unexpected changes to Ultimate Coming Soon & Maintenance plugin settings without a corresponding administrator action in audit logs
Access log entries showing plugin admin endpoints requested with Referer headers pointing to external, untrusted domains
Administrator sessions producing state-changing POST requests immediately after visiting third-party sites

Detection Strategies

Review WordPress audit logs for plugin configuration changes correlated to administrator browsing activity
Inspect HTTP access logs for POST requests to plugin endpoints missing valid _wpnonce parameters
Monitor for cross-origin Referer or Origin headers on privileged plugin routes

Monitoring Recommendations

Enable a WordPress security or activity plugin to record administrator actions with timestamps and source IP
Alert on plugin setting modifications performed outside of standard change windows
Track new or modified maintenance-mode pages that could be used to redirect legitimate visitors

How to Mitigate CVE-2025-24546

Immediate Actions Required

Identify all WordPress sites running Ultimate Coming Soon & Maintenance version 1.0.9 or earlier
Deactivate the plugin until a patched version is applied if administrative use is not essential
Require administrators to log out of the WordPress admin console when browsing untrusted sites

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2025-24546. Consult the Patchstack Vulnerability Report and the RSTheme vendor channels for updated plugin releases addressing the missing CSRF protections.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests to plugin endpoints lacking a valid _wpnonce parameter or a same-origin Referer header
Restrict access to /wp-admin/ by source IP where feasible using web server or WAF controls
Enforce short administrator session lifetimes and require re-authentication for sensitive actions

bash

# Example nginx rule to require same-origin Referer on WordPress admin POSTs
location ~* ^/wp-admin/admin-(post|ajax)\.php$ {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_referer ~* "^https?://your-site\.example/") {
            set $csrf_ok 1;
        }
        if ($csrf_ok = 0) {
            return 403;
        }
    }
}