CVE-2025-46452: Google News CSRF Vulnerability

CVE-2025-46452 Overview

CVE-2025-46452 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Olav Kolbu Google News plugin for WordPress. The flaw allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling persistent script injection through forged administrative requests. The vulnerability affects all versions of the Google News plugin up to and including 2.5.1. Successful exploitation requires a logged-in administrator to interact with an attacker-controlled page. Once exploited, attacker-supplied JavaScript persists in the WordPress backend and executes in the browser of any user who visits the affected page.

Critical Impact

Attackers can persistently inject JavaScript into a WordPress site by tricking an authenticated administrator into visiting a malicious page, leading to session theft, account takeover, or arbitrary backend modifications.

Affected Products

• Olav Kolbu Google News plugin for WordPress
• All versions through 2.5.1
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2025-04-24 - CVE-2025-46452 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-46452

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single exploitation chain. The Google News plugin exposes administrative actions without adequate anti-CSRF protection, such as missing or improperly validated WordPress nonces. An attacker hosts a crafted HTML page that issues forged state-changing requests to the plugin's settings endpoints. When an authenticated administrator visits the page, the browser submits the request with valid session cookies attached.

The second weakness lies in insufficient output sanitization. Input accepted through the forged request is stored in the WordPress database and later rendered without proper escaping. The result is a Stored XSS payload that executes whenever the affected admin page loads. The attack vector is network-based and requires user interaction, but no privileges of the attacker are needed.

Root Cause

The root cause is the absence of valid wp_nonce verification on privileged plugin actions, combined with missing sanitization of user-controlled input before it is persisted and rendered. Either control alone would block the attack; their combined absence enables CSRF-to-Stored-XSS.

Attack Vector

An attacker crafts a malicious web page containing a hidden form or asynchronous request targeting the vulnerable Google News plugin endpoint. The page is delivered through phishing, malvertising, or a compromised site. When an administrator with an active WordPress session visits the page, the forged request is submitted automatically. The payload is stored in plugin settings and later rendered to any visitor of the affected admin view, executing the injected script in their session context.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-46452

Indicators of Compromise

• Unexpected <script> tags, event handlers, or encoded JavaScript stored in Google News plugin settings within wp_options
• WordPress access logs showing POST requests to plugin admin endpoints with an external Referer header
• New or modified administrator accounts created shortly after an admin session
• Outbound browser requests from admin sessions to unfamiliar domains

Detection Strategies

• Review the wp_options table for serialized plugin configuration containing HTML or JavaScript content
• Audit web server logs for cross-origin POST requests to wp-admin paths associated with the Google News plugin
• Monitor browser-side Content Security Policy (CSP) violation reports from administrative pages
• Compare current plugin settings against known-good backups to identify unauthorized changes

Monitoring Recommendations

• Alert on modifications to active WordPress plugin settings outside of change-management windows
• Track administrative session activity for anomalous request patterns originating from external referrers
• Forward WordPress and web server logs to a centralized analytics platform for correlation and retention

How to Mitigate CVE-2025-46452

Immediate Actions Required

• Deactivate the Google News plugin until a patched version is confirmed and installed
• Audit the wp_options table and plugin settings for injected JavaScript and remove any malicious content
• Force a password reset for all administrator accounts and invalidate active WordPress sessions
• Review recent admin activity and plugin configuration changes for signs of unauthorized modification

Patch Information

At the time of publication, the advisory lists all versions through 2.5.1 as affected. Review the Patchstack Vulnerability Report for the latest fixed-version guidance and apply updates through the WordPress plugin management interface as soon as a patched release becomes available.

Workarounds

• Remove or deactivate the Google News plugin entirely if a patched version is unavailable
• Restrict access to /wp-admin/ using IP allowlists or a web application firewall (WAF)
• Deploy WAF rules that enforce same-origin checks on state-changing requests to WordPress admin endpoints
• Implement a strict Content Security Policy (CSP) for the WordPress admin interface to limit inline script execution

# Example: restrict wp-admin access by IP in nginx
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}