CVE-2025-46507: Unsafe Mimetypes CSRF Vulnerability

CVE-2025-46507 Overview

CVE-2025-46507 is a Cross-Site Request Forgery (CSRF) vulnerability in the Unsafe Mimetypes WordPress plugin (developed by ldrumm) that can be chained to achieve Stored Cross-Site Scripting (XSS). This vulnerability allows attackers to trick authenticated users into performing unintended actions, which can subsequently inject persistent malicious scripts into the affected WordPress site.

Critical Impact

This CSRF-to-Stored-XSS chain allows attackers to compromise authenticated user sessions, steal credentials, deface websites, and potentially gain administrative access to WordPress installations running vulnerable versions of the Unsafe Mimetypes plugin.

Affected Products

• Unsafe Mimetypes WordPress Plugin version 0.1.4 and earlier
• All installations of unsafe-mimetypes plugin from n/a through <= 0.1.4

Discovery Timeline

• 2025-04-24 - CVE-2025-46507 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46507

Vulnerability Analysis

This vulnerability combines two distinct attack vectors: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The Unsafe Mimetypes plugin fails to implement proper CSRF protection mechanisms (nonce verification) on critical form submissions, allowing attackers to craft malicious requests that execute actions on behalf of authenticated administrators.

When successfully exploited, the CSRF vulnerability enables an attacker to inject malicious JavaScript payloads that persist in the WordPress database. These Stored XSS payloads execute whenever users access the affected pages, making this a particularly dangerous attack chain. The vulnerability is network-accessible and requires user interaction (clicking a malicious link) but does not require prior authentication from the attacker's perspective.

Root Cause

The root cause of this vulnerability is classified under CWE-352 (Cross-Site Request Forgery). The Unsafe Mimetypes plugin does not properly validate security tokens (WordPress nonces) when processing form submissions in its administrative interface. This missing validation allows attackers to craft requests that appear legitimate to the server, bypassing the same-origin policy protections that would normally prevent such attacks.

Additionally, the plugin fails to properly sanitize and escape user-supplied input before storing it in the database and rendering it in HTML output, enabling the Stored XSS component of this attack chain.

Attack Vector

The attack is executed over the network and requires the victim (typically a WordPress administrator) to interact with a malicious page or click a crafted link while authenticated to the target WordPress site. The attacker creates a specially crafted HTML page containing a hidden form that submits malicious data to the vulnerable plugin endpoint. When an authenticated administrator visits this malicious page, the form automatically submits, injecting persistent XSS payloads into the WordPress installation.

The stored malicious scripts then execute in the context of any user who views the affected content, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

Detection Methods for CVE-2025-46507

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in plugin settings or database entries
• Unusual administrative actions logged without corresponding user activity
• Browser console errors indicating blocked or suspicious script execution
• Reports from users experiencing unexpected redirects or pop-ups on the WordPress site

Detection Strategies

• Monitor WordPress audit logs for administrative changes to the Unsafe Mimetypes plugin settings without corresponding authenticated sessions
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Deploy Web Application Firewall (WAF) rules to identify CSRF attack patterns targeting WordPress plugin endpoints
• Regularly scan the WordPress database for suspicious script tags or encoded JavaScript payloads

Monitoring Recommendations

• Enable WordPress security plugins that monitor for CSRF attempts and unauthorized form submissions
• Configure server-side logging to capture all POST requests to plugin administrative endpoints
• Set up alerts for changes to plugin configuration tables in the WordPress database
• Implement real-time monitoring for XSS indicators using browser-based detection mechanisms

How to Mitigate CVE-2025-46507

Immediate Actions Required

• Deactivate and remove the Unsafe Mimetypes plugin (unsafe-mimetypes) immediately if running version 0.1.4 or earlier
• Review WordPress database entries for any injected malicious scripts and sanitize affected content
• Force logout all authenticated users and require password resets for administrative accounts
• Audit recent administrative activity logs for signs of unauthorized changes

Patch Information

At the time of publication, no patched version of the Unsafe Mimetypes plugin has been identified. Users are strongly advised to deactivate and remove the plugin until a security update is released by the developer. For detailed information about this vulnerability, refer to the Patchstack Vulnerability Report.

Workarounds

• Implement additional CSRF protection at the web server level using custom rules or a WAF
• Restrict access to WordPress administrative pages by IP address using .htaccess or server configuration
• Deploy a WordPress security plugin that adds CSRF token validation across all forms
• Educate administrative users to avoid clicking unknown links while authenticated to WordPress

# Workaround: Restrict admin access by IP in .htaccess
<Files "admin.php">
    Order Deny,Allow
    Deny from all
    Allow from YOUR_TRUSTED_IP
</Files>

# Alternative: Block suspicious POST requests to plugin endpoints
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteRule wp-admin/admin-post\.php - [F,L]
</IfModule>