CVE-2025-24724: Side Menu Lite CSRF Vulnerability

CVE-2025-24724 Overview

CVE-2025-24724 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wow-Company Side Menu Lite WordPress plugin. The flaw affects all versions up to and including 5.3.1. An attacker can trick an authenticated administrator into submitting a forged request that modifies plugin settings without consent.

The vulnerability is classified under [CWE-352] and requires user interaction to succeed. Successful exploitation can alter plugin configuration, leading to limited integrity and availability impact on the affected WordPress site.

Critical Impact

An attacker can change Side Menu Lite plugin settings by luring an authenticated administrator to a malicious page, resulting in unauthorized configuration modifications.

Affected Products

• Wow-Company Side Menu Lite plugin for WordPress
• Side Menu Lite versions up to and including 5.3.1
• WordPress sites with the side-menu-lite plugin activated

Discovery Timeline

• 2025-01-24 - CVE-2025-24724 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24724

Vulnerability Analysis

The Side Menu Lite plugin exposes settings-change actions without validating a CSRF token. The plugin does not verify a WordPress nonce, or verifies it improperly, on state-changing requests. This allows a crafted third-party request to trigger administrative operations using the victim's authenticated session.

The attack requires user interaction. A logged-in administrator must visit an attacker-controlled page or click a malicious link while an active WordPress session exists. The request executes with the victim's privileges over the network.

Impact is limited to plugin configuration changes. Confidentiality is not affected, but attackers can degrade integrity and availability by altering menu behavior or injecting attacker-controlled settings values.

Root Cause

The root cause is missing or improper anti-CSRF protection on settings handlers within the side-menu-lite plugin. WordPress provides wp_nonce_field() and check_admin_referer() mechanisms for this purpose. When these controls are absent from a settings endpoint, any authenticated request originating from a third-party context is processed as legitimate.

Attack Vector

Exploitation proceeds by hosting an HTML page containing an auto-submitting form or image tag targeting the vulnerable settings endpoint on a WordPress site running Side Menu Lite. When an authenticated administrator loads the attacker's page, the browser transmits session cookies along with the forged request. The plugin processes the request and updates settings.

No authentication credentials are required from the attacker. The attacker relies entirely on the victim's active session and the missing nonce validation. See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-24724

Indicators of Compromise

• Unexpected changes to Side Menu Lite plugin settings without a corresponding administrator action in audit logs
• WordPress access log entries showing POST requests to Side Menu Lite settings endpoints with Referer headers pointing to external, untrusted domains
• Administrator sessions performing settings updates immediately after visiting external URLs

Detection Strategies

• Review HTTP request logs for POST requests targeting wp-admin pages associated with side-menu-lite that lack a valid nonce parameter
• Correlate plugin option updates in the wp_options table with authenticated admin session activity to spot forged submissions
• Monitor for anomalous Referer or Origin headers on WordPress administrative POST requests

Monitoring Recommendations

• Enable a WordPress activity log plugin to record all option and settings changes with user attribution
• Configure Web Application Firewall (WAF) rules that flag administrative POST requests missing _wpnonce or _wp_http_referer parameters
• Alert on plugin configuration changes occurring outside standard administrator workflows or maintenance windows

How to Mitigate CVE-2025-24724

Immediate Actions Required

• Update Side Menu Lite to a version released after 5.3.1 that addresses this CSRF issue once available from the vendor
• Restrict WordPress administrator accounts and require administrators to log out of active sessions when not actively managing the site
• Deploy a WAF rule set that enforces nonce validation on WordPress administrative endpoints

Patch Information

Refer to the Patchstack advisory for Side Menu Lite CSRF for the latest patch status. If no fixed version is published, consider deactivating the plugin until a patched release is available.

Workarounds

• Deactivate and remove the side-menu-lite plugin until a patched version is confirmed
• Enforce browser isolation for administrative sessions by using a dedicated browser profile only for WordPress administration
• Apply virtual patching through a WAF to require valid _wpnonce tokens on all plugin settings requests

# Example WAF rule concept to block requests missing WordPress nonces
# (ModSecurity-style pseudocode)
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain,deny,status:403,msg:'Missing WordPress nonce on admin action'"
    SecRule &ARGS:_wpnonce "@eq 0"