CVE-2025-47667 Overview
CVE-2025-47667 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the qusupport LiveAgent plugin for WordPress. The flaw impacts all plugin versions up to and including 4.4.7. An attacker can trick an authenticated user into submitting forged requests that trigger unintended state changes within the plugin. Exploitation requires user interaction, such as visiting a malicious page or clicking a crafted link. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows attackers to perform state-changing actions in the LiveAgent plugin on behalf of an authenticated victim, resulting in limited integrity and availability impact.
Affected Products
- qusupport LiveAgent WordPress plugin versions up to and including 4.4.7
- WordPress sites with the liveagent plugin installed and activated
- Administrative and support user sessions within affected WordPress installations
Discovery Timeline
- 2025-05-07 - CVE-2025-47667 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47667
Vulnerability Analysis
The vulnerability stems from missing or insufficient CSRF protections in the LiveAgent plugin. State-changing endpoints exposed by the plugin do not validate anti-CSRF tokens, commonly implemented in WordPress through the wp_nonce mechanism. An attacker who lures an authenticated user to a controlled page can force the browser to issue authenticated requests to the vulnerable site. The browser automatically includes session cookies, allowing the forged request to execute with the victim's privileges. The Patchstack advisory catalogs the issue as a WordPress plugin CSRF flaw within LiveAgent 4.4.7 and earlier.
Root Cause
The root cause is the absence of proper request origin validation on plugin action handlers. WordPress plugins are expected to use check_admin_referer() or wp_verify_nonce() on privileged operations. When these checks are missing, any authenticated request carrying valid session cookies is accepted, regardless of origin. This aligns with the [CWE-352] weakness class.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag targeting a vulnerable plugin endpoint. When an authenticated LiveAgent user visits the page, their browser transmits the forged request with valid authentication cookies. The server processes the request as legitimate, performing the attacker-chosen action. No credentials or elevated privileges are required from the attacker prior to exploitation. The vulnerability mechanism is described in the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2025-47667
Indicators of Compromise
- Unexpected configuration changes within the LiveAgent plugin settings not attributable to legitimate administrator activity.
- HTTP POST requests to LiveAgent plugin endpoints with Referer headers pointing to external, untrusted domains.
- Web server access logs showing authenticated plugin actions immediately following navigation to unfamiliar third-party sites.
Detection Strategies
- Inspect WordPress access logs for admin-ajax.php or plugin-specific endpoints invoked without a matching same-origin Referer.
- Monitor for absence of _wpnonce parameters in requests targeting LiveAgent action handlers.
- Correlate plugin state changes with the originating user session and referring URL to identify off-origin submissions.
Monitoring Recommendations
- Enable verbose logging on the LiveAgent plugin and forward WordPress audit logs to a centralized SIEM.
- Alert on plugin configuration modifications performed outside expected administrator IP ranges or maintenance windows.
- Track browser-driven POST requests carrying authenticated cookies but missing anti-CSRF tokens.
How to Mitigate CVE-2025-47667
Immediate Actions Required
- Update the LiveAgent plugin to a version later than 4.4.7 once the vendor publishes a patched release.
- Audit WordPress user accounts and revoke sessions for privileged users who may have interacted with untrusted content.
- Restrict administrative access to the WordPress dashboard using IP allow-listing or VPN gating.
Patch Information
At the time of the NVD entry, versions up to and including 4.4.7 are affected. Administrators should consult the Patchstack advisory for the latest fixed version and apply the vendor update as soon as it becomes available.
Workarounds
- Deactivate the LiveAgent plugin until a patched release is installed if the plugin is not business-critical.
- Deploy a Web Application Firewall (WAF) rule to block requests to LiveAgent endpoints lacking a valid _wpnonce parameter or same-origin Referer.
- Instruct administrators to log out of the WordPress dashboard when browsing unrelated sites to reduce CSRF exposure.
# Example WAF rule concept: reject POSTs to LiveAgent endpoints missing a same-origin Referer
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=liveagent" \
"phase:1,deny,status:403,chain,msg:'Potential CSRF against LiveAgent'"
SecRule &REQUEST_HEADERS:Referer "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
