CVE-2025-24572: WP Fast Total Search CSRF Vulnerability

CVE-2025-24572 Overview

CVE-2025-24572 is a Cross-Site Request Forgery (CSRF) vulnerability in the Epsiloncool WP Fast Total Search WordPress plugin (fulltext-search). The flaw affects all plugin versions up to and including 1.78.258. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions in the plugin's context. The vulnerability is tracked under CWE-352 and requires user interaction through a crafted link or page. Successful exploitation can lead to limited integrity and availability impact on the affected WordPress installation.

Critical Impact
Attackers can perform unauthorized state-changing actions in the plugin by luring an authenticated WordPress user to a malicious page, without requiring credentials.

Affected Products

Epsiloncool WP Fast Total Search (fulltext-search) WordPress plugin
All versions from initial release through 1.78.258
WordPress sites that have the plugin installed and activated

Discovery Timeline

2025-01-24 - CVE-2025-24572 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-24572

Vulnerability Analysis

The WP Fast Total Search plugin exposes one or more state-changing endpoints that do not validate the origin of incoming requests. Because the plugin lacks anti-CSRF tokens or equivalent request verification, a browser holding a valid WordPress session cookie will submit forged requests as the authenticated user. The attack is executed over the network without authentication on the attacker's side and requires the victim to visit an attacker-controlled page. The scope is unchanged and the impact is limited to integrity and availability of plugin-controlled data.

Root Cause

The root cause is missing CSRF protection in plugin request handlers, classified as [CWE-352]. WordPress provides nonce primitives such as wp_nonce_field(), wp_create_nonce(), and check_admin_referer() for exactly this purpose. Handlers in fulltext-search up to version 1.78.258 do not consistently validate nonces or verify the Referer header before executing privileged actions. Any authenticated session — including administrator sessions — can therefore be abused across origins.

Attack Vector

Exploitation requires an attacker to host a malicious page containing an auto-submitting HTML form or asynchronous request targeting a vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator or privileged user visits the page, the browser attaches the WordPress session cookies and the forged request is processed as legitimate. No credentials or user consent are collected by the attacker. Because the request is initiated from the victim's browser, network-layer controls and IP allow-lists do not mitigate the attack. The vulnerability mechanism is described in the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-24572

Indicators of Compromise

Unexpected configuration changes or data modifications in the WP Fast Total Search plugin without a corresponding admin action in the audit log.
HTTP POST requests to fulltext-search plugin endpoints containing an external Referer header or no Referer at all.
Administrator sessions performing plugin actions shortly after visiting untrusted external sites.

Detection Strategies

Inspect web server access logs for requests to /wp-admin/admin.php, /wp-admin/admin-ajax.php, or /wp-admin/admin-post.php referencing fulltext-search actions with cross-origin Referer values.
Enable WordPress activity logging to correlate privileged plugin actions with the source page and user session.
Compare running plugin version against 1.78.258 on all managed WordPress hosts using vulnerability management tooling.

Monitoring Recommendations

Alert on POST requests to plugin endpoints that are missing the WordPress _wpnonce parameter.
Monitor for spikes in 4xx or 5xx responses from fulltext-search handlers that may indicate probing.
Track administrator account activity for unusual timing patterns that align with browsing external, non-corporate domains.

How to Mitigate CVE-2025-24572

Immediate Actions Required

Update the WP Fast Total Search plugin to a version later than 1.78.258 as soon as a fixed release is available from the vendor.
If no fix is available, deactivate and remove the fulltext-search plugin until a patched version is published.
Force administrators to log out of active WordPress sessions and require re-authentication after remediation.

Patch Information

At the time of publication, the vendor advisory listed by Patchstack identifies all versions through 1.78.258 as vulnerable. Administrators should monitor the WordPress plugin repository for a release higher than 1.78.258 that introduces nonce validation via check_admin_referer() or wp_verify_nonce() on all state-changing actions.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to fulltext-search endpoints lacking a valid _wpnonce parameter or with an off-site Referer.
Restrict /wp-admin/ access to trusted IP ranges or via VPN to reduce exposure of authenticated sessions.
Instruct WordPress administrators to use a dedicated browser or browser profile for admin work and to log out immediately after each session.

bash

# Example NGINX rule to block cross-origin POSTs to the plugin endpoints
location ~ ^/wp-admin/(admin-ajax|admin-post|admin)\.php$ {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-wordpress-domain\.tld/") {
            return 403;
        }
    }
}