CVE-2025-24712: Radius Blocks CSRF Vulnerability

CVE-2025-24712 Overview

CVE-2025-24712 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the RadiusTheme Radius Blocks plugin for WordPress. The flaw affects all versions of radius-blocks up to and including 2.1.2. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions in the plugin. Exploitation requires user interaction but no privileges or authentication of the attacker. The vulnerability carries a network attack vector with low impact to integrity and availability, and no direct impact to confidentiality.

Critical Impact
An authenticated administrator visiting an attacker-controlled page can be forced to execute unwanted plugin actions in their WordPress site, potentially altering plugin configuration or content.

Affected Products

RadiusTheme Radius Blocks (radius-blocks) WordPress plugin
All versions from n/a through 2.1.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-24 - CVE-2025-24712 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24712

Vulnerability Analysis

The Radius Blocks plugin exposes one or more state-changing endpoints that do not validate an anti-CSRF token (WordPress nonce) before processing requests. As a result, requests originating from a third-party origin are treated as legitimate when accompanied by the victim's session cookies. The issue is classified under [CWE-352]: Cross-Site Request Forgery. The EPSS score of 0.199% reflects a low probability of exploitation within the next 30 days, but public disclosure via Patchstack lowers the barrier for opportunistic abuse against unpatched sites.

Root Cause

The root cause is missing or improperly implemented CSRF protection on one or more plugin request handlers. WordPress provides wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() primitives for this purpose. When these controls are absent, the browser automatically attaches the authenticated user's session cookie to cross-origin requests, allowing forged submissions to succeed.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or fetch() request targeting a vulnerable Radius Blocks endpoint on the victim's WordPress site. The attacker then lures a logged-in administrator or editor to the page via phishing, a forum link, or a compromised third-party site. Once the victim loads the page, the browser issues the forged request with valid session cookies, and the plugin executes the requested action. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-24712

Indicators of Compromise

Unexpected changes to Radius Blocks plugin settings or block content without corresponding admin activity in audit logs
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions immediately preceded by clicks on external links in email, chat, or forums

Detection Strategies

Inspect HTTP access logs for POST or state-changing GET requests to radius-blocks handlers where the Referer or Origin header does not match the site's own domain
Enable a WordPress activity log plugin to record plugin setting changes and correlate with authenticated user sessions
Deploy a Web Application Firewall (WAF) rule to flag requests to plugin admin endpoints missing a valid _wpnonce parameter

Monitoring Recommendations

Alert on outbound clicks from privileged WordPress users to unknown domains followed by administrative actions within a short time window
Monitor for spikes in 4xx/5xx responses on plugin endpoints indicating exploitation attempts
Track plugin version inventory across managed WordPress sites to identify hosts still running radius-blocks<= 2.1.2

How to Mitigate CVE-2025-24712

Immediate Actions Required

Identify all WordPress instances with the Radius Blocks plugin installed and confirm the installed version
Update Radius Blocks to a version later than 2.1.2 as soon as a fixed release is available from the vendor
Restrict administrative access to WordPress by enforcing separate browser sessions for admin work and reducing the number of privileged accounts

Patch Information

At the time of publication, the vulnerability affects Radius Blocks through version 2.1.2. Site owners should consult the Patchstack Vulnerability Report and the RadiusTheme plugin page for the latest fixed version and apply the update via the WordPress plugin manager.

Workarounds

Deactivate and remove the Radius Blocks plugin until a patched version is available if the plugin is not business-critical
Deploy a WAF or virtual patching solution (such as Patchstack or Wordfence) that enforces nonce validation on plugin endpoints
Require administrators to use a dedicated browser or browser profile for WordPress admin sessions to reduce cross-site request exposure
Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies where compatible

bash

# Example: identify vulnerable Radius Blocks installations using WP-CLI
wp plugin list --name=radius-blocks --fields=name,status,version

# Update the plugin once a fixed release is available
wp plugin update radius-blocks

# Temporary mitigation: deactivate the plugin site-wide
wp plugin deactivate radius-blocks