CVE-2025-46439: Plugin Central CSRF Vulnerability

CVE-2025-46439 Overview

CVE-2025-46439 is a Cross-Site Request Forgery (CSRF) vulnerability in the Vladimir Prelovac Plugin Central plugin for WordPress. The flaw chains CSRF [CWE-352] with a path traversal weakness, allowing attackers to trigger arbitrary file deletion on affected WordPress installations. The vulnerability affects all versions of Plugin Central up to and including 2.5.1. Successful exploitation requires an authenticated administrator to visit an attacker-controlled page or click a crafted link, after which the plugin processes a forged request that traverses the filesystem and deletes arbitrary files.

Critical Impact
An authenticated administrator tricked into visiting a malicious page can have arbitrary files deleted from the WordPress server, potentially enabling site takeover when wp-config.php is removed.

Affected Products

Vladimir Prelovac Plugin Central plugin for WordPress
All versions from initial release through 2.5.1
WordPress sites with the affected plugin installed and active

Discovery Timeline

2025-04-24 - CVE-2025-46439 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46439

Vulnerability Analysis

The Plugin Central plugin exposes a file management action that accepts a user-controlled file path parameter without enforcing CSRF protection through nonces or origin validation. The same handler fails to canonicalize or validate the supplied path, allowing ../ sequences to escape the plugin's intended working directory. Combining the missing CSRF token with the path traversal flaw produces a one-click arbitrary file deletion primitive.

When a logged-in WordPress administrator loads attacker-controlled content, the browser silently issues the forged request using the administrator's session cookies. The server-side handler then resolves the traversed path and removes the targeted file. Deleting wp-config.php triggers the WordPress installation flow, which an attacker can hijack by pointing the site to a database under their control. This converts the file deletion into full site takeover.

Root Cause

The root cause is the absence of a valid wp_nonce check on a privileged action combined with insufficient sanitization of a path parameter passed to a file deletion routine. Either control alone would mitigate the attack chain.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting form or image tag that issues a request to the vulnerable WordPress endpoint. When an authenticated administrator visits the page, the browser sends the request with valid session cookies, and the plugin processes the forged file deletion using the traversed path.

No verified exploit code is published for this issue. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-46439

Indicators of Compromise

Unexpected deletion of WordPress core files such as wp-config.php, index.php, or theme and plugin files
HTTP requests to Plugin Central admin handlers containing ../ or URL-encoded %2e%2e%2f sequences in path parameters
WordPress installations reverting to the initial setup screen without administrator action
Referer headers on Plugin Central admin actions pointing to external untrusted domains

Detection Strategies

Inspect web server access logs for POST or GET requests to Plugin Central endpoints with traversal patterns in query strings or form bodies
Alert on administrative actions where the HTTP Referer does not match the WordPress site origin
Monitor file integrity for the wp-content/plugins, wp-content/themes, and WordPress root directories

Monitoring Recommendations

Enable WordPress audit logging plugins to record plugin-initiated file operations and administrator session activity
Forward web access logs and file integrity events to a centralized SIEM for correlation across hosts
Track installed plugin versions across the fleet to identify unpatched Plugin Central instances at or below 2.5.1

How to Mitigate CVE-2025-46439

Immediate Actions Required

Identify all WordPress sites running Plugin Central version 2.5.1 or earlier and prioritize them for remediation
Deactivate and remove the Plugin Central plugin if a patched version is not yet available
Restrict administrator browsing habits and require separate browser profiles for WordPress administration
Back up wp-config.php and the WordPress filesystem before any remediation work

Patch Information

No fixed version is referenced in the NVD record at the time of publication. The vulnerability affects Plugin Central through 2.5.1. Consult the Patchstack Vulnerability Report for the latest vendor remediation guidance.

Workarounds

Deactivate Plugin Central until a patched release is confirmed
Deploy a Web Application Firewall (WAF) rule that blocks requests to Plugin Central endpoints containing .. traversal sequences
Enforce SameSite=Strict or Lax cookies for the WordPress session to reduce CSRF exposure from third-party origins
Require administrators to log out of WordPress when not actively managing the site

bash

# Example WAF rule fragment to block path traversal in Plugin Central requests
SecRule REQUEST_URI "@contains plugin-central" \
  "chain,deny,status:403,id:1004643901,msg:'Block CVE-2025-46439 traversal'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"