CVE-2025-48255: Videowhisper Live Streaming CSRF Flaw

CVE-2025-48255 Overview

CVE-2025-48255 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the VideoWhisper Broadcast Live Video plugin for WordPress, also known as videowhisper-live-streaming-integration. The flaw impacts all plugin versions up to and including 6.2.4. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions in the plugin. Successful exploitation requires user interaction but no privileges on the target site.

Critical Impact
Exploitation can lead to high impact on confidentiality, integrity, and availability of affected WordPress sites running the VideoWhisper Broadcast Live Video plugin through version 6.2.4.

Affected Products

VideoWhisper Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin
All versions from initial release through 6.2.4
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-19 - CVE-2025-48255 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-48255

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in the VideoWhisper Broadcast Live Video plugin. The plugin exposes state-changing actions that do not verify a WordPress nonce or other request origin token. An attacker hosting a malicious page can craft an HTML form or scripted request targeting the vulnerable endpoint. When an authenticated administrator or privileged user visits the attacker-controlled page, the browser submits the forged request with valid session cookies.

Because the attack reuses the victim's authenticated session, the plugin processes the request as legitimate. The required user interaction is limited to visiting a link or page, which lowers the barrier to exploitation in phishing scenarios. The CWE-352 classification confirms the root issue as missing protection against forged cross-origin requests.

Root Cause

The underlying defect is the absence of CSRF protection on sensitive plugin endpoints. WordPress provides wp_nonce_field() and check_admin_referer() for nonce generation and verification. The affected plugin code paths do not enforce nonce validation before executing privileged actions, allowing requests originating from external domains to be accepted.

Attack Vector

The attack is delivered over the network and requires a victim with an active authenticated WordPress session. An attacker lures the victim to a malicious page using phishing, malvertising, or a compromised site. The page auto-submits a hidden form or fetch request to the vulnerable plugin endpoint. The forged action executes under the victim's privileges, potentially altering plugin configuration, injecting content, or chaining into stored cross-site scripting or remote code execution.

No verified exploit code or public proof-of-concept is available at the time of publication. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-48255

Indicators of Compromise

Unexpected configuration changes within the VideoWhisper Broadcast Live Video plugin settings
WordPress administrator actions originating from external Referer headers or unfamiliar IP addresses
New or modified streaming endpoints, channels, or embed shortcodes added without administrator awareness
Webserver access logs showing POST requests to plugin admin endpoints lacking a valid _wpnonce parameter

Detection Strategies

Inspect WordPress audit logs for plugin setting changes correlated with administrator browsing activity
Monitor HTTP referer headers for plugin admin requests originating from domains outside the WordPress site
Review webserver logs for POST requests to /wp-admin/admin.php or admin-ajax.php targeting VideoWhisper actions without nonce tokens

Monitoring Recommendations

Deploy a WordPress audit plugin to record administrator actions, settings updates, and authentication events
Forward WordPress and webserver logs to a centralized SIEM for correlation across user sessions and request origins
Alert on anomalous POST traffic to plugin admin endpoints from unauthenticated referers or unusual geographies

How to Mitigate CVE-2025-48255

Immediate Actions Required

Update the VideoWhisper Broadcast Live Video plugin to a version newer than 6.2.4 as soon as a fixed release is published by the vendor
Audit recent administrator activity and plugin configuration for unauthorized modifications
Require administrators to log out of WordPress when not actively managing the site to reduce CSRF exposure

Patch Information

The advisory lists affected versions through 6.2.4. Site operators should consult the Patchstack WordPress Vulnerability Report and the VideoWhisper plugin page on WordPress.org for the latest patched release and apply it across all environments.

Workarounds

Deactivate the VideoWhisper Broadcast Live Video plugin until a patched version is available if live streaming functionality is not business-critical
Deploy a Web Application Firewall (WAF) rule to enforce same-origin Referer and Origin headers on plugin admin endpoints
Restrict access to /wp-admin/ by IP allowlist or VPN to limit exposure of authenticated administrator sessions
Train administrators to avoid clicking untrusted links while logged into WordPress

bash

# Example Apache configuration to enforce same-origin requests on wp-admin
<LocationMatch "^/wp-admin/">
    SetEnvIfNoCase Referer "^https://your-site\.example/" local_referer
    Require env local_referer
</LocationMatch>