CVE-2025-24749: EZPZ SAML SP SSO CSRF Vulnerability

CVE-2025-24749 Overview

CVE-2025-24749 is a Cross-Site Request Forgery (CSRF) vulnerability in the EZPZ SAML SP Single Sign On (SSO) WordPress plugin developed by Overt Software Solutions LTD. The flaw affects all plugin versions up to and including 1.2.5. According to the Patchstack advisory, the CSRF weakness chains into stored Cross-Site Scripting (XSS), allowing attackers to persist malicious payloads through forged requests. Exploitation requires user interaction, typically tricking an authenticated administrator into visiting an attacker-controlled page. The vulnerability is tracked under CWE-352.

Critical Impact
Attackers can chain forged administrator requests into stored XSS, enabling session hijacking, privilege abuse, and persistent payload delivery within WordPress sites running the EZPZ SAML SP SSO plugin.

Affected Products

EZPZ SAML SP Single Sign On (SSO) WordPress plugin versions up to and including 1.2.5
WordPress sites using the ezpz-sp plugin for SAML-based authentication
Overt Software Solutions LTD SSO integrations relying on the affected plugin

Discovery Timeline

2025-01-31 - CVE-2025-24749 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-24749

Vulnerability Analysis

The vulnerability resides in the EZPZ SAML SP SSO plugin's request-handling logic, where state-changing administrative actions accept requests without validating CSRF tokens. The Patchstack report classifies the issue as a CSRF that escalates to stored XSS, meaning a forged request can write attacker-controlled content into persistent storage. Once stored, the malicious script executes in the browser of any user who renders the affected page.

This vulnerability requires user interaction, which is consistent with CSRF exploitation patterns where an authenticated administrator must visit a malicious page or click a crafted link. The scope is changed because the injected script executes in the victim's browser context, beyond the vulnerable plugin's boundary.

Root Cause

The root cause is missing or insufficient anti-CSRF protections on plugin endpoints that modify configuration or content. The plugin does not adequately verify WordPress nonces (wp_verify_nonce) or equivalent origin checks before processing privileged write operations. Combined with insufficient output encoding on the stored data, the missing CSRF defense becomes a vector for persistent script injection.

Attack Vector

An attacker hosts a page containing a hidden form or fetch request targeting a vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator visits this page, the browser submits the forged request with valid session cookies. The plugin processes the request, persisting attacker-supplied JavaScript. Subsequent visits to the affected admin page execute the stored payload, enabling cookie theft, account takeover, or further lateral movement within the WordPress environment.

No public proof-of-concept exploit is currently available. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-24749

Indicators of Compromise

Unexpected <script> tags or HTML attributes containing JavaScript stored in EZPZ SAML SP plugin configuration fields
WordPress administrator activity logs showing plugin setting changes from unrecognized referrers or external origins
Outbound requests from administrator browsers to unfamiliar domains following plugin page visits

Detection Strategies

Audit the WordPress wp_options table and plugin-specific storage for entries belonging to ezpz-sp containing scriptable content such as <script, onerror=, or javascript:
Inspect web server access logs for POST requests to EZPZ SAML SP plugin endpoints lacking valid Referer or Origin headers matching the WordPress site
Correlate administrator session activity with cross-origin form submissions targeting wp-admin plugin URLs

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting modifications and identify the source IP and user agent
Deploy a Web Application Firewall (WAF) rule alerting on cross-origin POST requests to wp-admin endpoints associated with the ezpz-sp plugin
Monitor for anomalous JavaScript execution in administrator browsers using endpoint detection telemetry

How to Mitigate CVE-2025-24749

Immediate Actions Required

Update the EZPZ SAML SP Single Sign On (SSO) plugin to a version newer than 1.2.5 once a vendor patch is published
Review existing plugin configuration data and remove any unauthorized script content injected before remediation
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

The vulnerability affects EZPZ SAML SP SSO through version 1.2.5. Refer to the Patchstack advisory for the latest fixed version information and vendor remediation guidance.

Workarounds

Deactivate the EZPZ SAML SP SSO plugin until a fixed version is installed if SAML authentication is not actively required
Restrict administrator access to trusted networks using IP allowlisting at the web server or WAF layer
Train administrators to log out of WordPress sessions before browsing untrusted sites and to use isolated browser profiles for administrative tasks
Enforce SameSite cookie attributes (SameSite=Lax or Strict) on WordPress authentication cookies to reduce CSRF exposure

bash

# Example: enforce SameSite cookies via WordPress configuration
# Add to wp-config.php
@ini_set('session.cookie_samesite', 'Strict');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');