CVE-2025-49237: POEditor CSRF Vulnerability

CVE-2025-49237 Overview

CVE-2025-49237 is a Cross-Site Request Forgery (CSRF) vulnerability in the POEditor WordPress plugin that enables path traversal leading to arbitrary file deletion. The flaw affects all versions of POEditor up to and including 0.9.10. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized file deletion on the WordPress server. Because file deletion can target critical files such as wp-config.php, exploitation can render the site inoperable or force it into a reinstallation state that attackers may abuse for takeover.

Critical Impact
Successful exploitation enables arbitrary file deletion on the affected WordPress server, which can lead to denial of service or full site compromise when configuration files are removed.

Affected Products

POEditor WordPress plugin versions up to and including 0.9.10
WordPress installations with the POEditor plugin enabled
Sites where administrators may visit untrusted external content while authenticated

Discovery Timeline

2025-06-06 - CVE-2025-49237 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49237

Vulnerability Analysis

The vulnerability stems from a missing or insufficient CSRF protection on a file-handling endpoint in the POEditor plugin [CWE-352]. The affected endpoint accepts a file path parameter and performs a deletion operation without validating the request origin or a nonce token. Attackers can combine this CSRF weakness with path traversal sequences such as ../ to escape the intended directory and remove arbitrary files on the underlying filesystem.

Exploitation requires user interaction. An authenticated WordPress administrator must visit an attacker-controlled page while their session is active. The attacker's page issues a forged request to the vulnerable plugin endpoint, supplying a traversal payload that points to a sensitive file. The server executes the deletion in the context of the administrator, bypassing any UI-level checks.

The impact is limited to availability. The CVSS vector reflects no confidentiality or integrity loss but high availability impact, with scope change because deletion can affect files outside the plugin boundary. Removing files such as wp-config.php, theme assets, or plugin files can disable the site, expose installation wizards, or enable secondary attacks.

Root Cause

The root cause is the absence of a valid WordPress nonce check on a state-changing request and the lack of canonicalization on the file path parameter. Without nonce validation, the plugin cannot distinguish legitimate administrator actions from forged cross-origin requests. Without path normalization, traversal sequences resolve to arbitrary locations on disk.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a malicious page or injects an <img>, <form>, or fetch request into content viewed by an authenticated administrator. When the request reaches the vulnerable endpoint, the server processes it as if initiated from the WordPress admin interface. The traversal payload directs the deletion routine to a target file outside the plugin's expected scope.

The vulnerability manifests in the file-handling routine of the POEditor plugin. See the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-49237

Indicators of Compromise

Unexpected deletion of WordPress core files such as wp-config.php, index.php, or plugin and theme files.
HTTP requests to POEditor plugin endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in parameters.
WordPress sites entering the installation wizard state after an administrator browsing session.
Web server access logs showing POST or GET requests to plugin admin endpoints originating from external Referer headers.

Detection Strategies

Inspect web server and WordPress audit logs for requests to POEditor admin-ajax or admin-post handlers that lack a valid _wpnonce parameter.
Monitor filesystem changes under the WordPress installation directory and alert on unexpected deletions of .php files.
Correlate administrator authentication events with outbound browsing activity to identify potential CSRF delivery vectors.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root and write logs to a centralized location.
Track HTTP Referer and Origin headers on plugin endpoints and flag mismatches against the site's own domain.
Alert on any POEditor plugin requests that contain encoded or unencoded path separators in path or filename parameters.

How to Mitigate CVE-2025-49237

Immediate Actions Required

Deactivate the POEditor plugin until an updated version that addresses CVE-2025-49237 is installed.
Restrict administrator access to the WordPress admin interface from trusted networks only.
Audit the WordPress filesystem and restore any missing or modified files from a known-good backup.

Patch Information

At the time of publication, the Patchstack advisory identifies POEditor versions up to and including 0.9.10 as affected. Administrators should review the Patchstack WordPress Vulnerability Report for the latest patch availability and upgrade guidance.

Workarounds

Remove or disable the POEditor plugin from any production WordPress installation until a fixed version is confirmed.
Deploy a web application firewall rule that blocks requests to POEditor endpoints containing ../, ..\\, or encoded traversal sequences.
Enforce browser isolation or separate administrative browsing sessions to reduce CSRF exposure for privileged accounts.
Require re-authentication or step-up verification for sensitive plugin operations where supported.

bash

# Example WAF rule to block path traversal in POEditor requests
SecRule REQUEST_URI "@contains /wp-admin/admin" \
  "chain,deny,status:403,id:1004923,msg:'Block POEditor CSRF path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" "t:lowercase,t:urlDecodeUni"