CVE-2025-39601: WPFactory Custom CSS, JS & PHP CSRF Flaw

CVE-2025-39601 Overview

CVE-2025-39601 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPFactory Custom CSS, JS & PHP WordPress plugin that enables Remote Code Inclusion. This vulnerability allows attackers to trick authenticated administrators into executing malicious requests, ultimately leading to remote code execution on affected WordPress installations. The plugin, which allows site administrators to add custom CSS, JavaScript, and PHP code snippets to their WordPress sites, fails to properly validate the origin of requests, creating a pathway for attackers to inject and execute arbitrary code.

Critical Impact
Successful exploitation of this CSRF-to-RCE vulnerability chain allows unauthenticated attackers to execute arbitrary PHP code on the target server by manipulating an authenticated administrator, potentially leading to complete site compromise, data theft, and malware installation.

Affected Products

WPFactory Custom CSS, JS & PHP plugin versions up to and including 2.4.1
WordPress installations running vulnerable plugin versions
All web servers hosting affected WordPress sites

Discovery Timeline

2025-04-16 - CVE CVE-2025-39601 published to NVD
2025-04-16 - Last updated in NVD database

Technical Details for CVE-2025-39601

Vulnerability Analysis

This vulnerability represents a dangerous CSRF-to-RCE attack chain that targets WordPress administrators. The WPFactory Custom CSS, JS & PHP plugin provides functionality for administrators to inject custom code directly into their WordPress sites. However, the plugin fails to implement proper CSRF protections on its code-saving functionality.

When an authenticated administrator visits a malicious webpage crafted by an attacker, the page can silently submit requests to the vulnerable plugin endpoints. Because the plugin does not verify that requests originate from legitimate administrative actions (via nonce tokens or other anti-CSRF mechanisms), it processes the malicious request as if it were a legitimate administrative action.

The attack chain progresses from CSRF to Remote Code Inclusion because the plugin's core functionality involves saving and executing PHP code. An attacker can leverage the CSRF vulnerability to inject malicious PHP code that will be saved to the site and subsequently executed, granting the attacker full code execution capabilities on the web server.

Root Cause

The root cause of this vulnerability is the absence of proper CSRF token validation (CWE-352) in the plugin's code-saving functionality. The plugin fails to verify that form submissions and AJAX requests originate from legitimate administrative sessions using WordPress nonces or equivalent anti-CSRF mechanisms. This oversight allows external websites to forge requests that appear to come from authenticated administrators.

Attack Vector

The attack is network-based and requires user interaction—specifically, an authenticated WordPress administrator must visit a malicious page or click a malicious link while logged into the WordPress dashboard. The attacker creates a specially crafted HTML page containing hidden form fields or JavaScript that automatically submits requests to the vulnerable plugin endpoint. When the administrator views this page, the browser includes their WordPress session cookies, authenticating the forged request.

The attacker-controlled request can include arbitrary PHP code in the plugin's custom code fields. Once saved by the plugin, this malicious PHP code executes on subsequent page loads, giving the attacker remote code execution capabilities. This could allow the attacker to install backdoors, steal sensitive data, modify website content, or pivot to attack other systems on the network.

Detection Methods for CVE-2025-39601

Indicators of Compromise

Unexpected or suspicious PHP code snippets appearing in the Custom CSS, JS & PHP plugin settings
Unfamiliar PHP files in the WordPress installation directory, particularly in wp-content subdirectories
Unexplained outbound network connections from the web server to unknown external hosts
Web server access logs showing POST requests to plugin endpoints from external referrers
Modifications to WordPress database entries related to the custom-css plugin options

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block CSRF attempts targeting WordPress plugin endpoints
Monitor WordPress audit logs for changes to plugin settings that occur without corresponding legitimate administrative sessions
Deploy file integrity monitoring on the WordPress installation to detect unauthorized code modifications
Review web server access logs for requests to the plugin's AJAX handlers with suspicious external referrer headers

Monitoring Recommendations

Enable WordPress audit logging plugins to track all administrative actions including plugin configuration changes
Configure alerting for any modifications to PHP code stored by the Custom CSS, JS & PHP plugin
Monitor server-side execution logs for unusual PHP process spawning or command execution patterns
Implement network-level monitoring to detect unexpected outbound connections from the WordPress server

How to Mitigate CVE-2025-39601

Immediate Actions Required

Update the WPFactory Custom CSS, JS & PHP plugin to a patched version immediately if one is available
Temporarily deactivate the Custom CSS, JS & PHP plugin until a patch is applied
Review all custom PHP code currently stored in the plugin settings for any unauthorized or suspicious entries
Audit WordPress user accounts and remove any unexpected administrator accounts
Check for and remove any unfamiliar files in the WordPress installation directory

Patch Information

Security researchers have documented this vulnerability through the Patchstack WordPress Vulnerability Database. WordPress site administrators should check for plugin updates through the WordPress dashboard and apply any available security patches. If no patch is currently available, consider using alternative plugins that implement proper CSRF protections or restricting the plugin's functionality through server-side controls.

Workarounds

Disable the Custom CSS, JS & PHP plugin entirely until a security patch is released
Implement additional server-level protections using .htaccess rules to restrict access to the plugin's admin endpoints
Use a Web Application Firewall (WAF) with WordPress-specific rulesets to block CSRF attacks
Restrict WordPress administrator sessions to trusted IP addresses only
Ensure administrators log out of WordPress before browsing other websites to reduce CSRF attack surface

bash

# WordPress .htaccess restriction example for plugin admin endpoints
# Add to WordPress root .htaccess file to restrict plugin AJAX access

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Block external referrers from accessing plugin AJAX endpoints
  RewriteCond %{HTTP_REFERER} !^https?://your-domain\.com [NC]
  RewriteCond %{REQUEST_URI} wp-admin/admin-ajax\.php
  RewriteCond %{QUERY_STRING} action=.*custom[_-]css [NC]
  RewriteRule .* - [F,L]
</IfModule>