CVE-2025-26572: WP PHPList CSRF Vulnerability

CVE-2025-26572 Overview

CVE-2025-26572 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP PHPList plugin (phplist-form-integration) by jesseheap for WordPress. The flaw affects all versions through 1.7 and can be chained to achieve stored Cross-Site Scripting (XSS). An attacker can craft a malicious page that, when visited by an authenticated administrator, forces the browser to submit a forged request to the vulnerable plugin. The issue is tracked under [CWE-352] (Cross-Site Request Forgery).

Critical Impact
Successful exploitation allows an unauthenticated attacker to inject persistent JavaScript into the WordPress site by tricking a logged-in administrator into visiting an attacker-controlled page.

Affected Products

WP PHPList (phplist-form-integration) plugin for WordPress
All versions from n/a through 1.7
WordPress installations using the jesseheap WP PHPList integration

Discovery Timeline

2025-02-13 - CVE-2025-26572 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26572

Vulnerability Analysis

The WP PHPList plugin fails to validate the origin of state-changing HTTP requests submitted to its administrative endpoints. Because no anti-CSRF token (such as a WordPress nonce) is required or correctly verified, the plugin accepts any authenticated request that reaches it with a valid session cookie. The vulnerability is rated with a network attack vector and requires user interaction, reflecting the need for an administrator to visit an attacker-controlled page. Exploitation crosses a security scope boundary because the injected payload executes in the trust context of the WordPress admin interface.

Root Cause

The root cause is missing or improperly implemented CSRF protection on form submission handlers in phplist-form-integration. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected handlers do not enforce them on plugin configuration updates. Combined with insufficient output encoding on stored values, the CSRF flaw escalates into a stored XSS condition (CSRF-to-XSS).

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or fetch request that targets the vulnerable plugin endpoint on a WordPress site. The attacker then lures an authenticated administrator to that page through phishing, a forum post, or a malicious advertisement. The administrator's browser submits the request with valid authentication cookies, and the plugin processes it as legitimate. The forged request stores attacker-controlled JavaScript that executes whenever the affected page is rendered, enabling session theft, account takeover, or further compromise of the WordPress instance. For technical details, see the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-26572

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers in plugin configuration fields stored in the WordPress database (wp_options or plugin-specific tables).
Administrator HTTP POST requests to phplist-form-integration endpoints with Referer headers pointing to external domains.
New or modified administrator accounts created shortly after an admin visited an untrusted external site.

Detection Strategies

Inspect web server access logs for POST requests to plugin admin URLs where the Referer header is missing or originates outside the WordPress domain.
Audit plugin configuration values for HTML or JavaScript content that should not appear in normal text fields.
Monitor WordPress audit logs for option updates tied to phplist-form-integration that occur outside scheduled maintenance windows.

Monitoring Recommendations

Enable a WordPress activity logging plugin to track configuration changes by user and source IP.
Deploy a Web Application Firewall (WAF) rule that blocks requests to plugin admin endpoints lacking a valid nonce parameter.
Alert on browser-side Content Security Policy (CSP) violations from the WordPress admin interface to surface injected scripts.

How to Mitigate CVE-2025-26572

Immediate Actions Required

Update the WP PHPList (phplist-form-integration) plugin to a version newer than 1.7 once the vendor releases a fix.
Disable or remove the plugin if a patched version is not yet available.
Force a password reset for all WordPress administrator accounts and invalidate active sessions.
Review plugin configuration values and remove any unexpected HTML or JavaScript content.

Patch Information

No fixed version is referenced in the current advisory. Refer to the Patchstack WordPress Vulnerability advisory for vendor patch status and monitor the WordPress plugin repository for updates beyond version 1.7.

Workarounds

Restrict access to the WordPress admin interface using IP allow-listing at the web server or WAF layer.
Require administrators to use a separate browser profile for WordPress administration to limit cross-site cookie exposure.
Apply a WAF rule that enforces same-origin Referer and Origin headers on POST requests to /wp-admin/ endpoints associated with the plugin.
Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin context.

bash

# Example WAF rule (ModSecurity) to block cross-origin POSTs to plugin admin endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "id:1002601,phase:1,deny,status:403,\
  chain,msg:'CVE-2025-26572 - Cross-origin POST to phplist-form-integration blocked'"
  SecRule REQUEST_URI "@contains phplist-form-integration" \
    "chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-wordpress-site.example"