CVE-2025-24720 Overview
CVE-2025-24720 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wow-Company Sticky Buttons plugin for WordPress. The flaw affects all versions up to and including 4.1.1. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, modifies the plugin's settings without the administrator's consent. The weakness maps to CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction but no prior authentication on the attacker's side.
Critical Impact
Attackers can alter Sticky Buttons plugin settings on affected WordPress sites by tricking an authenticated administrator into loading a malicious page.
Affected Products
- Wow-Company Sticky Buttons WordPress plugin, versions up to and including 4.1.1
Discovery Timeline
- 2025-01-24 - CVE-2025-24720 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24720
Vulnerability Analysis
The Sticky Buttons plugin exposes administrative setting-change actions without adequate CSRF protection. The plugin's settings handlers do not validate a request-bound anti-CSRF token (WordPress nonce) or fail to enforce nonce verification before applying changes. An attacker who lures an authenticated WordPress administrator into visiting a malicious page can cause the browser to submit a forged state-changing request to the target site using the administrator's active session cookies.
Because the request originates from the victim's authenticated browser, the plugin processes it as a legitimate administrative action. The attacker does not need credentials, but success depends on the victim being logged in as an administrator when the payload executes. The impact is limited to plugin configuration changes, which can still be leveraged to alter site behavior or button destinations.
Root Cause
The root cause is missing or improperly implemented CSRF protection on the plugin's settings-update endpoints. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF defense. When these are absent or not verified server-side before executing state-changing logic, any authenticated request the browser sends is accepted regardless of origin.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting HTML form or JavaScript that issues a POST request to the vulnerable Sticky Buttons settings endpoint on the target WordPress site. When a logged-in administrator visits the page, the browser attaches the session cookies and the plugin applies the attacker-supplied settings.
See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-24720
Indicators of Compromise
- Unexpected modifications to Sticky Buttons plugin settings in the WordPress database, particularly in wp_options rows related to the plugin.
- Admin-area POST requests to Sticky Buttons settings endpoints with Referer headers pointing to external or unfamiliar domains.
- WordPress audit-log entries showing settings changes without corresponding administrator activity in the admin console.
Detection Strategies
- Review web server access logs for POST requests to the plugin's admin action handlers that lack an expected _wpnonce parameter or contain suspicious Referer values.
- Enable a WordPress activity/audit logging plugin to capture setting-change events with source IP, user, and referrer metadata.
- Compare current plugin settings against a known-good baseline to identify unauthorized changes.
Monitoring Recommendations
- Alert on plugin option changes occurring outside scheduled administrative maintenance windows.
- Monitor administrator sessions for concurrent activity from multiple IP addresses or geographies.
- Track browser referrer anomalies on admin endpoints via a web application firewall (WAF).
How to Mitigate CVE-2025-24720
Immediate Actions Required
- Update the Sticky Buttons plugin to a version released after 4.1.1 that includes the CSRF fix once available from the vendor.
- Restrict administrator accounts and require administrators to log out of WordPress when not actively managing the site.
- Deploy a WAF rule that blocks cross-origin POST requests to WordPress plugin admin endpoints.
Patch Information
Refer to the Patchstack advisory for the latest fixed-version information. Apply the vendor-supplied update through the WordPress plugin manager as soon as it is available.
Workarounds
- Deactivate the Sticky Buttons plugin until a patched version is installed.
- Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-site request exposure.
- Require administrators to use a separate browser profile or session for WordPress administration to limit exposure to malicious third-party pages.
# Example: disable the plugin via WP-CLI until a patched version is available
wp plugin deactivate sticky-buttons
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
