CVE-2025-25093: Child Themes Helper CSRF Vulnerability

CVE-2025-25093 Overview

CVE-2025-25093 is a Cross-Site Request Forgery (CSRF) vulnerability in the Child Themes Helper WordPress plugin developed by paulswarthout. The flaw allows path traversal, which attackers can chain with the CSRF condition to trigger arbitrary file deletion on the target WordPress installation. The vulnerability affects Child Themes Helper versions up to and including 2.2.7. Exploitation requires an authenticated user to visit an attacker-controlled page while logged into a vulnerable WordPress site. Successful exploitation can delete critical files, disrupting site availability and potentially enabling further compromise. This issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can trick an authenticated WordPress user into submitting a forged request that deletes arbitrary files on the server, leading to loss of site availability.

Affected Products

Child Themes Helper plugin for WordPress (child-themes-helper)
All versions from n/a through 2.2.7
WordPress sites with the Child Themes Helper plugin installed and activated

Discovery Timeline

2025-02-07 - CVE CVE-2025-25093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25093

Vulnerability Analysis

The vulnerability combines two weaknesses in the Child Themes Helper plugin. The plugin fails to validate the origin or authenticity of state-changing requests, which is the CSRF condition described in [CWE-352]. Compounding this, the plugin accepts file path parameters without sufficient sanitization, allowing directory traversal sequences such as ../ to reference files outside the intended directory. When an authenticated administrator visits a malicious page, the browser submits a forged request that causes the plugin to delete a file at an attacker-chosen location. The result is arbitrary file deletion within the WordPress instance. Deletion of files such as wp-config.php can force WordPress into setup mode, enabling site takeover under certain conditions.

Root Cause

The plugin lacks CSRF protection tokens (WordPress nonces) on file management endpoints and does not sanitize user-controlled path input before performing file system operations. This combination of missing anti-CSRF controls and improper path validation permits both unauthorized request forgery and traversal outside the plugin's intended scope.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker crafts a web page that automatically submits a request to the vulnerable plugin endpoint on a target WordPress site. When an authenticated user, typically an administrator, visits the malicious page, the browser sends the forged request with valid session cookies. The plugin processes the request and deletes the file specified by the traversal payload. Attack complexity is elevated because the attacker must know or guess the target's URL and time the request during an active session.

No verified public proof-of-concept code is available. See the Patchstack WordPress Vulnerability advisory for additional technical detail.

Detection Methods for CVE-2025-25093

Indicators of Compromise

Unexpected deletion of WordPress core files, theme files, or plugin files, especially wp-config.php or files outside the plugin directory.
Web server access logs showing POST requests to Child Themes Helper endpoints with ../ sequences in parameters.
Referer headers on plugin requests pointing to external, untrusted domains.
WordPress site suddenly redirecting to the installation wizard, indicating wp-config.php deletion.

Detection Strategies

Monitor HTTP request logs for path traversal patterns (..%2F, ../) targeting wp-admin/admin.php or wp-admin/admin-post.php with Child Themes Helper action parameters.
Enable file integrity monitoring on the WordPress installation to detect unauthorized file deletions.
Inspect requests to the plugin missing the standard WordPress _wpnonce parameter, which suggests forged submissions.

Monitoring Recommendations

Alert on any deletion event affecting files outside the wp-content/themes/ directory when the Child Themes Helper plugin is active.
Track outbound referer domains on admin-area requests to identify cross-origin submissions from untrusted sources.
Correlate administrator session activity with unexpected file system changes on the underlying web host.

How to Mitigate CVE-2025-25093

Immediate Actions Required

Deactivate the Child Themes Helper plugin until an official patched version above 2.2.7 is confirmed available and installed.
Restrict administrator browsing habits and require administrators to use a separate browser or profile for WordPress management to reduce CSRF exposure.
Back up the WordPress site, including wp-config.php and the database, before making changes.

Patch Information

At the time of this writing, the vulnerability affects all versions through 2.2.7. Consult the Patchstack advisory for the latest fixed version information. Apply the vendor-supplied update as soon as a patched release is available through the WordPress plugin repository.

Workarounds

Remove the Child Themes Helper plugin entirely if child theme management is not required.
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin containing ../ or URL-encoded traversal sequences.
Enforce SameSite=Strict or SameSite=Lax cookies on WordPress session cookies to reduce cross-origin request success.
Limit administrative access by IP allowlist on wp-admin/ to reduce the attack surface for CSRF delivery.

bash

# Example nginx rule to block traversal against the plugin endpoint
location ~* /wp-admin/admin(-post|)\.php {
    if ($args ~* "child.themes.helper.*\.\.(%2f|/)") {
        return 403;
    }
}