CVE-2025-48265: WooCommerce YMM Search CSRF Vulnerability

CVE-2025-48265 Overview

CVE-2025-48265 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Pektsekye Year Make Model Search for WooCommerce WordPress plugin (ymm-search). The flaw impacts all versions up to and including 1.0.11. An attacker can trick an authenticated administrator into submitting a forged request that changes plugin settings without consent. The weakness is classified under CWE-352 and requires user interaction to succeed. Exploitation occurs over the network without authentication on the attacker's side, though it depends on the victim's active session.

Critical Impact
Successful exploitation allows attackers to modify Year Make Model Search plugin settings on affected WooCommerce stores by luring an authenticated administrator to a malicious page.

Affected Products

Pektsekye Year Make Model Search for WooCommerce plugin (ymm-search)
All versions from initial release through 1.0.11
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2025-05-19 - CVE-2025-48265 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48265

Vulnerability Analysis

The Year Make Model Search for WooCommerce plugin exposes settings-modification endpoints without adequate anti-CSRF protections. WordPress plugins are expected to validate a nonce via wp_verify_nonce() or check_admin_referer() on any state-changing request. The affected plugin fails to enforce this check on its settings handlers through version 1.0.11. As a result, a crafted HTML form or image tag hosted on an attacker-controlled domain can trigger privileged actions using the administrator's browser session.

Exploitation requires the target administrator to visit a malicious page while authenticated to the WordPress admin panel. The attack does not require the attacker to hold credentials on the target site. Impact is limited to integrity of the plugin configuration, with no direct confidentiality or availability loss documented. The EPSS probability is 0.128%, placing exploitation likelihood in the lower percentile of tracked CVEs.

Root Cause

The root cause is missing CSRF token validation on plugin settings requests. WordPress provides the nonce mechanism specifically to bind form submissions to a user session, and the plugin does not consume it correctly on the vulnerable endpoints.

Attack Vector

An attacker hosts a page containing a hidden form that auto-submits to the WordPress admin URL handling the plugin's settings update. When an authenticated administrator loads the page, the browser transmits the request with valid session cookies. The server processes the change because no nonce is validated. See the Patchstack advisory for additional detail.

Detection Methods for CVE-2025-48265

Indicators of Compromise

Unexpected modifications to Year Make Model Search plugin settings in the WordPress database (wp_options table entries related to ymm-search).
Administrator account activity in web server logs immediately following visits to unfamiliar external domains via the Referer header.
POST requests to plugin admin endpoints lacking a valid _wpnonce parameter.

Detection Strategies

Enable and review WordPress audit logging to flag configuration changes to the ymm-search plugin.
Correlate outbound referrer patterns with subsequent admin-panel POST requests to identify cross-origin submissions.
Deploy a web application firewall rule that inspects admin-area POST requests for a valid nonce field.

Monitoring Recommendations

Monitor the plugin version deployed across WordPress fleets and alert on installations at or below 1.0.11.
Track authenticated admin sessions for anomalous cross-site request patterns using reverse proxy or CDN logs.
Alert on any modification to plugin option keys outside scheduled maintenance windows.

How to Mitigate CVE-2025-48265

Immediate Actions Required

Update the Year Make Model Search for WooCommerce plugin to a version above 1.0.11 once a fixed release is available from the vendor.
If no patched version exists, deactivate and remove the ymm-search plugin until a fix is published.
Instruct administrators to log out of WordPress sessions when not actively performing management tasks.

Patch Information

Refer to the Patchstack advisory for ymm-search for current fix status. Versions through 1.0.11 are confirmed vulnerable. Apply the vendor-supplied update as soon as it is released.

Workarounds

Restrict access to /wp-admin/ by source IP address at the web server or firewall layer.
Require administrators to use separate browsers or browser profiles for WordPress management sessions.
Deploy a WAF rule that blocks admin POST requests missing the WordPress _wpnonce parameter.

bash

# Example nginx configuration to restrict wp-admin access by IP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny  all;
    try_files $uri $uri/ /index.php?$args;
}