CVE-2025-25146: Songkick Concerts CSRF Vulnerability

CVE-2025-25146 Overview

CVE-2025-25146 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the saleandro Songkick Concerts and Festivals WordPress plugin. The flaw impacts all versions up to and including 0.9.7. An attacker can trick an authenticated user into submitting a forged request that performs unintended actions within the plugin. The vulnerability is tracked under CWE-352 and requires user interaction to succeed. Successful exploitation can lead to limited integrity impact on the target WordPress site.

Critical Impact
An attacker can coerce authenticated WordPress users into executing unauthorized plugin actions by visiting a malicious page, resulting in limited integrity impact on the site.

Affected Products

Songkick Concerts and Festivals WordPress plugin (songkick-concerts-and-festivals)
All versions from n/a through 0.9.7
Vendor: saleandro

Discovery Timeline

2025-02-07 - CVE CVE-2025-25146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25146

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented CSRF protections in the Songkick Concerts and Festivals plugin. WordPress plugins commonly rely on nonces generated by wp_create_nonce() and verified through check_admin_referer() or wp_verify_nonce() to prevent forged requests. When these controls are absent, any authenticated action exposed by the plugin can be triggered by a cross-origin request the victim's browser automatically authenticates using session cookies.

The attack requires user interaction. A victim who is logged into WordPress must visit an attacker-controlled page or click a crafted link. The browser then submits the forged request against the vulnerable plugin endpoint, executing the action under the victim's privileges.

Root Cause

The root cause is the absence of anti-CSRF tokens or referer validation on state-changing plugin endpoints in songkick-concerts-and-festivals versions up to 0.9.7. Without nonce verification, the plugin cannot distinguish between legitimate requests from the WordPress admin interface and forged requests originating from external sites.

Attack Vector

The attack vector is network-based and requires the victim to interact with attacker-controlled content while authenticated to the WordPress site. The attacker crafts an HTML page containing an auto-submitting form or image tag that points to the vulnerable plugin endpoint. When the victim loads the page, the browser sends the request with the victim's session cookies, causing the plugin to execute the action. Confidentiality and availability are not affected, but integrity impact is possible within the scope of what the plugin can modify.

See the Patchstack WordPress Plugin Vulnerability advisory for additional technical detail.

Detection Methods for CVE-2025-25146

Indicators of Compromise

Unexpected changes to plugin settings or content configured through songkick-concerts-and-festivals administrative pages.
HTTP POST or GET requests to plugin endpoints where the Referer header points to an external, untrusted domain.
Web server access logs showing authenticated admin actions initiated shortly after users visited untrusted external URLs.

Detection Strategies

Review WordPress audit logs for administrative actions tied to the Songkick plugin that lack a corresponding legitimate admin session.
Inspect HTTP request logs for requests to plugin endpoints missing valid nonce parameters (_wpnonce) or with mismatched Referer headers.
Deploy a Web Application Firewall (WAF) rule to flag cross-origin POST requests targeting /wp-admin/ endpoints associated with the plugin.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record all administrator and editor actions with source IP and referrer.
Monitor for anomalous outbound requests from admin browsers that could indicate CSRF payload delivery.
Alert on modifications to plugin configuration files or database options associated with songkick-concerts-and-festivals.

How to Mitigate CVE-2025-25146

Immediate Actions Required

Disable the Songkick Concerts and Festivals plugin until a patched version is available and deployed.
Instruct WordPress administrators and editors to log out when not actively managing the site, reducing the window for CSRF exploitation.
Review recent plugin activity for signs of unauthorized changes and revert any suspicious modifications.

Patch Information

At the time of publication, no fixed version is listed for songkick-concerts-and-festivals. The vulnerability affects all versions up to and including 0.9.7. Consult the Patchstack advisory for the current patch status and upgrade guidance.

Workarounds

Uninstall the plugin if a patched release is not available and the functionality is not essential.
Restrict access to the WordPress admin interface using IP allowlisting or an authenticated reverse proxy.
Deploy a WAF rule to enforce Referer and Origin header validation on state-changing requests to /wp-admin/.
Require administrators to use isolated browsers or profiles for WordPress administration to prevent cross-site interaction with untrusted content.

bash

# Example WAF rule concept (ModSecurity) to block cross-origin POSTs to wp-admin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:1,deny,status:403,id:1002501,msg:'Blocked cross-origin POST to wp-admin'"
SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example"