CVE-2025-24568: Starter Templates Astra Sites CSRF Flaw

CVE-2025-24568 Overview

CVE-2025-24568 is a Cross-Site Request Forgery (CSRF) vulnerability in the Brainstorm Force Starter Templates plugin (astra-sites) for WordPress. The flaw affects all versions up to and including 4.4.9. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, causes the WordPress site to perform unintended state-changing actions. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Authenticated WordPress users can be coerced into executing unauthorized actions on sites running the vulnerable Starter Templates plugin, resulting in limited integrity impact.

Affected Products

Brainstorm Force Starter Templates (astra-sites) plugin for WordPress
All versions from initial release through 4.4.9
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-24 - CVE-2025-24568 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24568

Vulnerability Analysis

The Starter Templates plugin exposes one or more state-changing endpoints that do not adequately verify the origin of incoming requests. WordPress plugins are expected to validate nonces on privileged actions using functions such as wp_verify_nonce() or check_admin_referer(). When these checks are missing or improperly implemented, the browser's automatic inclusion of session cookies allows a remote attacker to trigger actions on behalf of an authenticated victim.

The vulnerability requires user interaction, meaning the target must click a link or load a page controlled by the attacker while authenticated to the WordPress site. Successful exploitation results in low integrity impact without affecting confidentiality or availability. The EPSS score of 0.205% reflects a low current probability of observed exploitation attempts.

Root Cause

The root cause is missing or insufficient CSRF token validation on request handlers registered by the astra-sites plugin. WordPress relies on nonce-based anti-CSRF tokens tied to user sessions, and any handler that mutates state without verifying a valid nonce is exposed to forged requests originating from external domains.

Attack Vector

The attack vector is network-based and requires no privileges on the target site. An attacker hosts a page containing a crafted HTML form or JavaScript that automatically submits a request to the vulnerable plugin endpoint. When a logged-in administrator or contributor visits that page, the browser attaches valid authentication cookies to the request. The vulnerable handler processes the action as legitimate. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-24568

Indicators of Compromise

Unexpected changes to Starter Templates plugin settings, imported templates, or site configuration made outside of normal administrator activity
HTTP requests to astra-sites plugin endpoints with Referer headers pointing to unrelated external domains
Plugin actions occurring during administrator browsing sessions on third-party sites

Detection Strategies

Review WordPress audit logs for state-changing plugin actions that lack a corresponding administrator-initiated workflow
Inspect web server access logs for POST requests to admin-ajax.php or plugin-specific endpoints containing astra-sites action parameters with suspicious referrers
Correlate administrator login sessions with plugin configuration changes to identify anomalies

Monitoring Recommendations

Enable WordPress activity logging to capture plugin configuration and content changes with user attribution
Monitor outbound HTTP referrers on administrator workstations to identify visits to unknown domains preceding site changes
Alert on Starter Templates plugin actions executed without corresponding admin dashboard navigation in access logs

How to Mitigate CVE-2025-24568

Immediate Actions Required

Update the Brainstorm Force Starter Templates plugin to a version later than 4.4.9 as soon as a fixed release is available from the vendor
Restrict administrator browsing habits and require administrators to use dedicated browsers or sessions for WordPress management
Audit recent plugin actions and site configuration to confirm no unauthorized changes have occurred

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version and vendor patch information. Apply the update through the WordPress plugin manager or via WP-CLI once available.

Workarounds

Deactivate the Starter Templates plugin until a patched version is installed if it is not actively required
Deploy a web application firewall rule to block requests to astra-sites action handlers that lack a same-origin Referer or Origin header
Enforce strict SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies to reduce cross-origin request risk

bash

# Disable the vulnerable plugin using WP-CLI until a patch is applied
wp plugin deactivate astra-sites

# Verify plugin status
wp plugin status astra-sites