CVE-2025-26570: Glance That Plugin CSRF Vulnerability

CVE-2025-26570 Overview

CVE-2025-26570 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the uamv Glance That WordPress plugin through version 4.9. The flaw enables attackers to trick authenticated users into submitting unintended requests that modify plugin state. Public reporting from Patchstack indicates the CSRF condition can be chained into stored Cross-Site Scripting (XSS), expanding the impact beyond simple state changes. The vulnerability is tracked under [CWE-352] and requires user interaction over the network.

Critical Impact
Successful exploitation lets attackers inject persistent payloads through forged requests, leading to stored XSS that executes in administrator browsers and impacts confidentiality, integrity, and availability of affected WordPress sites.

Affected Products

uamv Glance That WordPress plugin versions through 4.9
WordPress sites with the Glance That plugin installed and active
Any administrator session accessing a malicious page while authenticated to a vulnerable site

Discovery Timeline

2025-02-13 - CVE-2025-26570 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26570

Vulnerability Analysis

The Glance That plugin exposes state-changing endpoints that do not validate request origin. Attackers craft a malicious page that triggers an HTTP request to the vulnerable plugin handler when a logged-in WordPress user visits it. Because the browser automatically attaches the user's session cookies, the request executes with the victim's privileges.

Patchstack classifies this as a CSRF leading to stored XSS. The forged request writes attacker-controlled content into plugin storage without proper sanitization. When an administrator later renders the affected interface, the injected script executes in the administrative context.

This chain elevates the impact from a single forged action to persistent script execution. Attackers can steal session tokens, create rogue admin accounts, or pivot to remote code execution through plugin or theme editors.

Root Cause

The root cause is the absence of anti-CSRF tokens on state-changing requests. WordPress provides the wp_nonce_field() and check_admin_referer() primitives precisely for this purpose, but the affected handlers in Glance That through version 4.9 do not enforce nonce validation. Output sanitization on the stored content is also insufficient, enabling the secondary XSS payload.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting form or fetch() call targeting the vulnerable plugin endpoint. The attacker then lures an authenticated WordPress user, typically an administrator, to visit the page through phishing or a watering-hole technique. The browser issues the request with valid authentication cookies, the plugin processes it as legitimate, and the attacker's payload is stored. See the Patchstack advisory for the disclosure record.

Detection Methods for CVE-2025-26570

Indicators of Compromise

Unexpected POST requests to Glance That plugin endpoints with Referer headers pointing to third-party domains
New or modified Glance That entries containing <script>, onerror=, onload=, or javascript: payloads
Administrator sessions making outbound requests to unknown domains shortly after viewing plugin-rendered pages
Creation of new WordPress administrator accounts or modification of user roles immediately after plugin interaction

Detection Strategies

Inspect web server access logs for state-changing requests to Glance That handlers that lack a same-origin Referer header
Scan the WordPress database for stored Glance That records containing HTML or JavaScript tags
Monitor for unusual administrator activity following clicks on external links, which can indicate CSRF exploitation
Deploy a Web Application Firewall (WAF) rule that flags POST requests to plugin endpoints without a valid nonce parameter

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration changes and user account modifications
Alert on the appearance of script-like content in plugin database tables through scheduled integrity checks
Correlate administrator login events with subsequent plugin write operations to identify forged requests

How to Mitigate CVE-2025-26570

Immediate Actions Required

Deactivate the Glance That plugin until a patched version above 4.9 is confirmed available and installed
Review the WordPress administrator account list and remove any accounts created without authorization
Audit Glance That database entries and remove any records containing script content or suspicious HTML
Force a password reset for all administrator accounts and invalidate active sessions

Patch Information

At the time of NVD publication, the advisory lists affected versions through 4.9 with no fixed version explicitly confirmed in the available data. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release that adds nonce validation and output sanitization.

Workarounds

Restrict access to the WordPress administrative interface by IP allowlist at the web server or WAF layer
Require administrators to use separate browser profiles or sessions when managing WordPress to limit CSRF exposure
Deploy a WAF rule that blocks requests to Glance That endpoints missing a valid _wpnonce parameter
Apply Content Security Policy (CSP) headers that restrict inline script execution in the admin dashboard

bash

# Example WAF rule (ModSecurity) to block CSRF requests missing a nonce
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
  "chain,id:1002601,phase:2,deny,status:403,msg:'Glance That CSRF block'"
SecRule ARGS:page "@streq glance-that" \
  "chain"
SecRule &ARGS:_wpnonce "@eq 0"