CVE-2025-47551: Wiki Embed CSRF Vulnerability

CVE-2025-47551 Overview

CVE-2025-47551 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ctltwp Wiki Embed plugin for WordPress. The flaw exists in all versions up to and including 1.4.6. An attacker can trick an authenticated administrator into submitting a forged request that changes plugin settings without consent. The issue is tracked under CWE-352 and requires user interaction to exploit.

Critical Impact
Successful exploitation allows unauthorized modification of Wiki Embed plugin settings when an authenticated administrator visits an attacker-controlled page.

Affected Products

ctltwp Wiki Embed WordPress plugin
Versions from n/a through 1.4.6
WordPress installations using the vulnerable plugin

Discovery Timeline

2025-05-07 - CVE-2025-47551 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47551

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in the Wiki Embed plugin settings handlers. WordPress plugins typically enforce request authenticity using nonces generated by wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce(). When these checks are absent, any state-changing form submission can be forged by an external site.

An attacker crafts a malicious HTML page containing a form or JavaScript that submits a request to the vulnerable settings endpoint. If a logged-in WordPress administrator visits the page, the browser sends the request with valid session cookies, and the plugin processes it as legitimate. The impact is limited to integrity of plugin configuration, with no direct confidentiality or availability effect.

Root Cause

The root cause is missing CSRF protection on settings-change actions in the Wiki Embed plugin. The plugin does not verify that the request originated from an authorized WordPress admin page. This maps directly to CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation requires an authenticated WordPress administrator to interact with attacker-controlled content, such as clicking a link or loading a page containing a hidden form. The attack is network-based and requires no authentication on the attacker's side. See the Patchstack CVE Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-47551

Indicators of Compromise

Unexpected changes to Wiki Embed plugin settings without a corresponding admin action in audit logs
HTTP POST requests to Wiki Embed settings endpoints with Referer headers pointing to external domains
Administrator sessions submitting settings updates shortly after browsing external sites

Detection Strategies

Review WordPress activity logs for plugin configuration changes and correlate with administrator browsing activity
Inspect web server logs for POST requests to Wiki Embed admin endpoints where the Referer header is missing or off-site
Monitor for the absence of _wpnonce parameters in settings-change requests targeting the plugin

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture settings changes with user, timestamp, and source IP
Alert on administrator account activity originating from unusual referrers or IP addresses
Track plugin version inventory to identify sites still running Wiki Embed 1.4.6 or earlier

How to Mitigate CVE-2025-47551

Immediate Actions Required

Identify all WordPress sites running the Wiki Embed plugin and confirm installed versions
Deactivate the Wiki Embed plugin on affected sites until a patched release is applied
Instruct administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

At the time of publication, no fixed version is listed in the enriched data. Consult the Patchstack CVE Vulnerability Report for current fix status and vendor updates.

Workarounds

Restrict access to /wp-admin/ using IP allowlists or authentication at the web server layer
Deploy a Web Application Firewall (WAF) rule to block requests to the plugin's settings endpoints that lack a valid same-origin Referer
Use browser session isolation so administrators do not browse untrusted sites while authenticated to WordPress

bash

# Example nginx snippet enforcing same-origin Referer on wp-admin POST requests
location ^~ /wp-admin/ {
    if ($request_method = POST) {
        set $ref_ok 0;
        if ($http_referer ~* "^https?://your-domain\.tld/") { set $ref_ok 1; }
        if ($ref_ok = 0) { return 403; }
    }
}