CVE-2025-47596: Beacon Lead Magnets CSRF Vulnerability

CVE-2025-47596 Overview

CVE-2025-47596 is a Cross-Site Request Forgery (CSRF) vulnerability in the Syed Balkhi Beacon Lead Magnets and Lead Capture WordPress plugin (beacon-by). The flaw affects all plugin versions up to and including 1.5.8. An attacker can trick an authenticated user into submitting a forged request that performs unintended state-changing actions in the plugin. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation requires user interaction but can result in unauthorized modification of plugin state through a victim's authenticated session.

Affected Products

Syed Balkhi Beacon Lead Magnets and Lead Capture (beacon-by) plugin for WordPress
All versions from n/a through 1.5.8
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-07 - CVE-2025-47596 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47596

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented CSRF protection in the Beacon Lead Magnets and Lead Capture plugin. State-changing HTTP endpoints in the plugin do not validate a WordPress nonce or equivalent anti-CSRF token before performing privileged operations. An attacker hosts a crafted page or link that triggers an authenticated request when a logged-in WordPress user visits it. The browser attaches the victim's session cookies, and the plugin processes the request as legitimate. Because the CVSS vector indicates limited integrity impact with no confidentiality or availability impact, the attacker's actions are bounded by the state changes the vulnerable endpoint permits.

Root Cause

The plugin fails to enforce anti-CSRF controls on one or more request handlers, as classified under CWE-352. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the vulnerable code paths in versions through 1.5.8 do not verify a token bound to the user session.

Attack Vector

The attack is network-based and requires user interaction. An attacker delivers a malicious link or embeds a hidden form on an attacker-controlled page. When an authenticated WordPress user with sufficient privileges loads that page, the browser issues the forged request to the target site. No prior authentication of the attacker is required. Refer to the Patchstack Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-47596

Indicators of Compromise

Unexpected configuration changes within Beacon Lead Magnets plugin settings following an administrator browsing session.
Web server access logs showing POST requests to beacon-by plugin endpoints with Referer headers pointing to external, untrusted origins.
Administrator sessions issuing state-changing requests without a corresponding preceding admin UI navigation trail.

Detection Strategies

Inspect HTTP logs for requests to plugin admin endpoints that lack a valid _wpnonce parameter or contain suspicious Referer values.
Monitor WordPress audit logs for plugin configuration modifications correlated with administrator browsing activity on external sites.
Compare installed plugin version against the vulnerable range using WordPress site inventory tooling.

Monitoring Recommendations

Enable a WordPress activity log plugin to capture setting changes performed against beacon-by endpoints.
Alert on outbound admin-area POST requests originating from cross-origin Referer headers.
Track plugin version drift and flag any site still running beacon-by at version 1.5.8 or earlier.

How to Mitigate CVE-2025-47596

Immediate Actions Required

Identify all WordPress installations running the Beacon Lead Magnets and Lead Capture plugin and confirm the installed version.
Deactivate the plugin on any site running version 1.5.8 or earlier until a patched release is applied.
Instruct administrators to log out of WordPress before browsing untrusted sites to reduce forged-request exposure.

Patch Information

At the time of the NVD entry, the advisory lists affected versions from n/a through <= 1.5.8. Consult the Patchstack Vulnerability Advisory and the plugin's WordPress.org page for the latest fixed release, and update to a version newer than 1.5.8 once available.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks state-changing POST requests to plugin endpoints when Referer or Origin headers do not match the site's own domain.
Restrict WordPress administrator access to a dedicated browser profile that does not visit untrusted external content.
Remove the plugin entirely if lead-capture functionality is not in active use.

bash

# Example: enforce same-origin admin POSTs in nginx as a compensating control
location ~* /wp-admin/admin-(ajax|post)\.php$ {
    if ($request_method = POST) {
        set $csrf_block "1";
        if ($http_origin ~* "^https?://your-site\.example$") { set $csrf_block "0"; }
        if ($csrf_block = "1") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}