CVE-2025-48099: Search & Filter Plugin CSRF Vulnerability

CVE-2025-48099 Overview

CVE-2025-48099 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Code Amp Search & Filter WordPress plugin. The flaw impacts all versions up to and including 1.2.17. It is categorized under [CWE-352] and can be chained with an open redirect condition, allowing attackers to abuse authenticated user sessions to trigger unwanted state changes or redirect victims to attacker-controlled destinations.

Exploitation requires user interaction, typically by tricking an authenticated site user into clicking a crafted link or visiting a malicious page. The scope is changed, meaning the impact extends beyond the vulnerable component to affect the browsing user.

Critical Impact
An attacker can forge requests on behalf of an authenticated WordPress user and leverage the resulting open redirect to send victims to arbitrary URLs for phishing or malware delivery.

Affected Products

Code Amp Search & Filter WordPress plugin (search-filter)
All versions from n/a through <= 1.2.17
WordPress installations using the vulnerable plugin

Discovery Timeline

2025-10-22 - CVE-2025-48099 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48099

Vulnerability Analysis

The vulnerability stems from missing or improper anti-CSRF protections in the Search & Filter WordPress plugin. The plugin fails to validate the origin of state-changing HTTP requests, so an attacker can craft a request that the victim's browser submits automatically when authenticated to the target WordPress site.

Because the CSRF flaw is chained with an open redirect, the attacker can steer the victim's browser to any URL. This turns a same-origin exploit into a broader phishing or malware distribution vector. The attack requires user interaction such as clicking a link, and no privileges are needed by the attacker.

Root Cause

The root cause is the absence of adequate CSRF countermeasures such as WordPress nonces (wp_verify_nonce), SameSite cookie enforcement, or origin/referer validation on sensitive endpoints. Without these controls, the plugin trusts any authenticated request regardless of where it originated. Combined with unvalidated redirect target parameters, this allows attackers to craft URLs that both bypass origin checks and redirect users off-site.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious page or delivers a crafted link via email, chat, or a compromised site. When an authenticated WordPress user with the plugin installed clicks the link or loads the page, the browser submits the forged request. The vulnerable endpoint processes the request and issues a redirect to the attacker-supplied URL. The victim lands on a phishing page or malware host under the attacker's control.

See the Patchstack advisory for the Search & Filter plugin for technical details.

Detection Methods for CVE-2025-48099

Indicators of Compromise

Web server access logs showing requests to Search & Filter plugin endpoints with Referer headers pointing to unfamiliar external domains.
HTTP 30x redirect responses from plugin endpoints with Location headers pointing to non-site URLs.
Unusual spikes in outbound clicks from authenticated user sessions to unexpected external hosts.

Detection Strategies

Monitor WordPress access logs for requests to search-filter plugin routes lacking valid nonce parameters.
Alert on responses containing redirect headers whose target host does not match the site's allowlist.
Correlate authenticated session activity with cross-origin Referer values to identify potential CSRF attempts.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized analytics platform for retention and querying.
Track plugin version inventory across all WordPress instances to identify hosts still running search-filter <= 1.2.17.
Implement web application firewall (WAF) rules that inspect referer headers and block cross-origin POST requests to plugin endpoints.

How to Mitigate CVE-2025-48099

Immediate Actions Required

Update the Code Amp Search & Filter plugin to a version later than 1.2.17 as soon as the vendor releases a fixed release.
If no fix is available, deactivate and remove the plugin from all affected WordPress installations.
Review WordPress user accounts for signs of unauthorized activity or redirected sessions.

Patch Information

At the time of publication, the vulnerability affects all versions through 1.2.17. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest patched release. Apply updates through the WordPress admin dashboard or wp-cli.

Workarounds

Deploy a WAF rule that blocks cross-origin state-changing requests targeting the Search & Filter plugin endpoints.
Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce CSRF exposure.
Restrict administrative access to trusted networks using IP allowlists at the reverse proxy or firewall layer.

bash

# Update the vulnerable plugin using wp-cli once a patched version is released
wp plugin update search-filter

# Alternatively, deactivate and remove the plugin if no fix is available
wp plugin deactivate search-filter
wp plugin delete search-filter