CVE-2025-46524: WP Filter Post Category CSRF Vulnerability

CVE-2025-46524 Overview

CVE-2025-46524 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Filter Post Category WordPress plugin developed by stesvis. The flaw affects all plugin versions up to and including 2.1.4. Attackers can chain the CSRF flaw with stored Cross-Site Scripting (XSS), allowing injected payloads to persist in the WordPress database and execute in the browsers of subsequent visitors. The weakness is classified under CWE-352, Cross-Site Request Forgery.

Critical Impact
An unauthenticated attacker can trick an authenticated administrator into submitting a forged request that injects persistent JavaScript into the WordPress site, leading to session hijacking or further compromise.

Affected Products

stesvis WP Filter Post Category plugin for WordPress
All versions from initial release through 2.1.4
WordPress sites with the plugin installed and an authenticated administrator session

Discovery Timeline

2025-04-24 - CVE-2025-46524 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46524

Vulnerability Analysis

The vulnerability combines two web application weaknesses. The plugin's state-changing endpoints lack anti-CSRF tokens, so the server cannot verify that requests originate from a legitimate user-initiated action. Combined with insufficient output encoding on stored input fields, an attacker can force a logged-in administrator's browser to submit a malicious request that persists a JavaScript payload into the site's configuration or post data.

When any user later loads a page that renders the affected stored data, the script executes in their browser within the site's origin. The payload runs with the privileges of the viewing user, which often includes administrators. Successful exploitation can lead to administrator account takeover, plugin installation, or arbitrary content modification.

Root Cause

The root cause is the absence of CSRF protection on plugin actions that modify persistent state, paired with missing sanitization or escaping of user-supplied input. WordPress provides the wp_nonce_field() and check_admin_referer() helpers to mitigate CSRF, and wp_kses() or esc_html() to enforce output safety. The vulnerable code paths in WP Filter Post Category do not consistently apply these controls.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious page or sends a crafted link to a WordPress administrator. When the administrator visits the page while authenticated, their browser issues the forged request to the vulnerable plugin endpoint. The request stores attacker-controlled markup that is later rendered without escaping, triggering stored XSS execution. No prior authentication on the attacker's side is required.

The vulnerability mechanism is described in detail in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-46524

Indicators of Compromise

Unexpected <script>, <svg onload=>, or event-handler attributes stored in plugin-managed options or post metadata.
WordPress administrator accounts created or modified outside of normal change windows.
Outbound requests from administrator browsers to unfamiliar domains immediately after loading wp-admin pages.
Modifications to plugin settings without corresponding entries in the WordPress audit log.

Detection Strategies

Scan the WordPress database for HTML and JavaScript artifacts in fields managed by the wp-filter-post-categories plugin.
Monitor HTTP POST requests to plugin endpoints lacking a valid _wpnonce parameter or Referer header matching the site origin.
Review web server access logs for cross-origin POST requests targeting /wp-admin/admin.php or /wp-admin/admin-post.php with plugin-specific action parameters.

Monitoring Recommendations

Enable a Content Security Policy (CSP) and alert on CSP violation reports originating from administrator sessions.
Forward WordPress and web server logs to a centralized analytics pipeline and correlate authentication events with plugin configuration changes.
Track plugin file integrity and database option changes with periodic baseline comparisons.

How to Mitigate CVE-2025-46524

Immediate Actions Required

Deactivate and remove the WP Filter Post Category plugin until a patched release is verified.
Audit WordPress options, post content, and user metadata for injected scripts and remove malicious entries.
Force password resets and session invalidation for all administrator accounts.
Restrict wp-admin access to known IP ranges where operationally feasible.

Patch Information

At the time of NVD publication, no fixed version above 2.1.4 is identified in the advisory. Site operators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for updated guidance and apply any vendor-released patch immediately upon availability.

Workarounds

Remove the plugin entirely if a patched version is not yet available.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin endpoints lacking a same-origin Referer and a valid _wpnonce value.
Apply a strict Content Security Policy that disallows inline scripts in the WordPress admin area to reduce stored XSS execution impact.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-filter-post-categories
wp plugin delete wp-filter-post-categories