CVE-2025-47614 Overview
CVE-2025-47614 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Chris Clark LessButtons Social Sharing and Statistics plugin for WordPress. The flaw exists in all plugin versions up to and including 1.6.1. An attacker can trick an authenticated administrator into submitting a forged request that modifies plugin settings without their consent. Exploitation requires user interaction, typically by luring a logged-in administrator to a malicious page. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows an unauthenticated attacker to change LessButtons plugin settings by abusing an authenticated administrator's session, resulting in integrity impact to the WordPress configuration.
Affected Products
- Chris Clark LessButtons Social Sharing and Statistics plugin for WordPress
- All versions from n/a through <= 1.6.1
- WordPress installations with the lessbuttons plugin active
Discovery Timeline
- 2025-05-07 - CVE-2025-47614 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47614
Vulnerability Analysis
The vulnerability stems from missing or improperly validated anti-CSRF tokens on administrative actions inside the LessButtons plugin. Administrative endpoints that update plugin configuration accept state-changing requests without verifying a valid WordPress nonce or equivalent origin control. An attacker crafts a malicious HTML page containing a form or JavaScript payload targeting the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser automatically attaches the WordPress session cookie to the outbound request. The target site processes the request as if the administrator initiated it and applies the attacker-supplied settings.
Root Cause
The root cause is the absence of proper CSRF protection on settings-change handlers in the lessbuttons plugin. WordPress plugins are expected to validate requests using wp_nonce_field() and check_admin_referer() or wp_verify_nonce(). The affected handlers do not enforce this check, allowing cross-origin requests to succeed when accompanied by a valid session cookie.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a page containing a hidden form or fetch() request pointing at the vulnerable plugin endpoint on a target WordPress site. A logged-in administrator visiting that page triggers the forged request. The exploitation mechanism does not require credentials or prior access to the target site, only the ability to entice an administrator to load attacker-controlled content. Refer to the Patchstack Vulnerability Report for endpoint-level details.
Detection Methods for CVE-2025-47614
Indicators of Compromise
- Unexpected changes to LessButtons plugin settings in the WordPress admin database, particularly in wp_options rows related to the plugin.
- HTTP POST requests to LessButtons admin endpoints with Referer headers pointing to external, non-administrative domains.
- Administrator session activity coinciding with visits to unfamiliar or untrusted external websites.
Detection Strategies
- Review web server access logs for POST requests to wp-admin endpoints associated with the lessbuttons plugin that lack a same-origin Referer or Origin header.
- Monitor WordPress audit logs for configuration changes to the LessButtons plugin that do not correlate with legitimate administrator activity.
- Deploy a Web Application Firewall (WAF) rule to flag state-changing requests to plugin endpoints without a valid _wpnonce parameter.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture settings changes with timestamps and user attribution.
- Alert on outbound administrator navigation to unknown domains immediately preceding plugin configuration changes.
- Track version numbers of installed WordPress plugins across your estate to identify unpatched lessbuttons deployments at or below 1.6.1.
How to Mitigate CVE-2025-47614
Immediate Actions Required
- Identify all WordPress instances running the LessButtons Social Sharing and Statistics plugin at version 1.6.1 or earlier.
- Deactivate the plugin until a patched version becomes available if it is not required for business operations.
- Instruct administrators to log out of WordPress when not actively managing the site and to avoid browsing untrusted content in the same browser session.
Patch Information
At the time of publication, no fixed version is listed in the enriched CVE data. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for a vendor-issued update, and apply it as soon as it is released.
Workarounds
- Remove or deactivate the lessbuttons plugin until a patched release is verified.
- Enforce administrator use of a dedicated browser or browser profile that does not visit untrusted external sites.
- Deploy a WAF rule that blocks requests to LessButtons admin endpoints missing a valid _wpnonce token or a same-origin Referer header.
# Example WAF rule (ModSecurity) to block CSRF-style requests to the plugin
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
"chain,phase:2,deny,status:403,id:1004761401,\
msg:'Blocked CSRF attempt against lessbuttons plugin'"
SecRule ARGS:page "@streq lessbuttons" \
"chain"
SecRule &ARGS:_wpnonce "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
