CVE-2025-27344: Phee's LinkPreview CSRF Vulnerability

CVE-2025-27344 Overview

CVE-2025-27344 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Phee's LinkPreview plugin for WordPress, developed by filipstepanov. The flaw impacts all plugin versions up to and including 1.6.7. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unintended state-changing actions in the plugin without the user's consent. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed.

Critical Impact
An authenticated user visiting an attacker-controlled page can be forced to perform plugin actions in their WordPress session, resulting in limited integrity impact to the target site.

Affected Products

Phee's LinkPreview WordPress plugin versions through 1.6.7
WordPress installations with the linkpreview plugin enabled
Sites where administrators or privileged users interact with the plugin interface

Discovery Timeline

2025-02-24 - CVE-2025-27344 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27344

Vulnerability Analysis

The Phee's LinkPreview plugin fails to validate the origin of state-changing HTTP requests. WordPress plugins are expected to implement nonce-based CSRF protections using functions such as wp_nonce_field() and check_admin_referer(). When these safeguards are missing or improperly implemented, a browser session belonging to an authenticated user can be abused to submit forged requests to the target site.

An attacker exploiting this issue does not need credentials on the target WordPress installation. Instead, the attacker relies on a logged-in user visiting a malicious page or clicking a crafted link. The user's authenticated cookies are automatically included in the forged request, causing the plugin to process it as legitimate.

The impact is limited to integrity. Confidentiality and availability are not affected according to the vector. See the Patchstack WordPress Vulnerability Advisory for the vendor coordination details.

Root Cause

The root cause is missing or insufficient CSRF token validation on requests handled by the linkpreview plugin. The plugin does not verify a valid WordPress nonce or check the request Referer before executing sensitive operations. This design defect matches CWE-352.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious HTML page that auto-submits a form or issues a JavaScript-driven request to the vulnerable WordPress endpoint. The attacker distributes the link through phishing, comments, or third-party sites. When a logged-in WordPress user browses to the malicious content, the request executes with the user's privileges against the target site.

No verified public exploit code is available for this issue. The vulnerability mechanism is documented in the referenced Patchstack advisory.

Detection Methods for CVE-2025-27344

Indicators of Compromise

Unexpected changes to LinkPreview plugin settings or generated link previews without a corresponding admin action in the audit log
WordPress access logs showing POST requests to linkpreview plugin endpoints with external Referer headers
Administrator sessions submitting plugin actions immediately after visiting untrusted external URLs

Detection Strategies

Enable a WordPress activity log plugin to track configuration changes made through the LinkPreview plugin
Inspect web server logs for POST requests to plugin admin endpoints that originate from off-site referrers
Review browser session activity for authenticated administrators against suspicious external navigation events

Monitoring Recommendations

Monitor changes to plugin options stored in the wp_options table for keys associated with linkpreview
Alert on administrative POST actions lacking a valid _wpnonce parameter in captured request logs
Correlate WordPress admin actions with user browsing telemetry to detect CSRF patterns

How to Mitigate CVE-2025-27344

Immediate Actions Required

Deactivate the Phee's LinkPreview plugin until a patched release addressing CVE-2025-27344 is confirmed installed
Restrict WordPress administrator accounts from browsing untrusted external sites in the same session as admin work
Enforce strong session controls and short cookie lifetimes for privileged WordPress users

Patch Information

At the time of NVD publication, no fixed version beyond 1.6.7 has been indicated in the referenced advisory. Site owners should monitor the Patchstack WordPress Vulnerability Advisory and the plugin's WordPress.org listing for a patched release, and apply the update as soon as it is available.

Workarounds

Remove or disable the linkpreview plugin if it is not essential to site operations
Deploy a Web Application Firewall rule that requires a valid _wpnonce parameter on plugin admin POST requests
Configure the WordPress SameSite=Lax or Strict cookie attribute for authentication cookies to reduce cross-site request risk
Limit administrative access to trusted IP ranges through server-level access controls

bash

# Example: WAF rule pattern to block CSRF against the plugin endpoint
# Reject POST requests to linkpreview admin actions missing a WordPress nonce
SecRule REQUEST_METHOD "@streq POST" \
    "chain,deny,status:403,id:1002734,\
    msg:'CVE-2025-27344 CSRF - missing _wpnonce for linkpreview'"
    SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
        "chain"
        SecRule ARGS:page "@contains linkpreview" \
            "chain"
            SecRule &ARGS:_wpnonce "@eq 0"