CVE-2025-49439: Atelier Create CV CSRF Vulnerability

CVE-2025-49439 Overview

CVE-2025-49439 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Atelier Create CV WordPress plugin by mariusz88atelierweb. The flaw exists in all plugin versions up to and including 1.1.5. An attacker can trick an authenticated administrator into submitting forged requests that alter plugin settings without consent. Exploitation requires user interaction, typically by luring a logged-in target to visit a malicious page. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation permits unauthorized modification of plugin settings on affected WordPress sites when an authenticated user visits attacker-controlled content.

Affected Products

Atelier Create CV WordPress plugin versions through 1.1.5
WordPress installations with the atelier-create-cv plugin active
Sites where administrators may browse external content while authenticated

Discovery Timeline

2025-06-06 - CVE-2025-49439 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49439

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in state-changing requests handled by the Atelier Create CV plugin. WordPress provides wp_nonce_field() and check_admin_referer() primitives to prevent forged requests, but the affected code paths do not enforce nonce validation on privileged actions. An attacker crafts a malicious HTML page containing a form or script that targets the plugin's settings endpoint. When a logged-in administrator visits that page, the browser automatically attaches session cookies, and the request executes with the victim's privileges. The impact is limited to integrity of plugin configuration, with no direct confidentiality or availability consequences noted in the advisory.

Root Cause

The root cause is the absence of proper CSRF protections on plugin settings handlers. The plugin trusts the presence of an authenticated session as sufficient authorization, without verifying that the request originated from a legitimate first-party form.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker hosts a malicious page and uses phishing, forum posts, or comments to entice a WordPress administrator into visiting it while authenticated. See the Patchstack Vulnerability Overview for additional technical detail.

No verified public exploit code is available. The vulnerability mechanism is a standard forged POST or GET request against the plugin's admin-facing settings endpoint, executed in the context of an authenticated administrator's browser session.

Detection Methods for CVE-2025-49439

Indicators of Compromise

Unexpected modifications to Atelier Create CV plugin settings recorded in WordPress option changes or audit logs
HTTP referrer headers on plugin settings requests pointing to unrelated external domains
Administrator actions originating from unusual IP addresses or user agents shortly after external browsing activity

Detection Strategies

Enable WordPress audit logging plugins to capture changes to plugin options and settings tables
Inspect web server access logs for POST requests to wp-admin endpoints associated with atelier-create-cv that lack a same-origin referrer
Correlate administrator authentication events with subsequent settings changes to identify anomalous sequences

Monitoring Recommendations

Alert on modifications to plugin configuration outside of scheduled maintenance windows
Monitor for outbound links or content on the site referencing external domains introduced through altered settings
Track plugin version inventory to confirm all instances are updated beyond the vulnerable range

How to Mitigate CVE-2025-49439

Immediate Actions Required

Identify all WordPress sites running the Atelier Create CV plugin at version 1.1.5 or earlier
Deactivate the plugin on affected sites until a patched release is verified and applied
Instruct administrators to log out of WordPress before browsing untrusted content
Review plugin settings for unauthorized changes and restore known-good values

Patch Information

At the time of this writing, the NVD entry indicates the vulnerability affects versions through 1.1.5. Review the Patchstack Vulnerability Overview for the current fixed version and apply the vendor update as soon as it becomes available.

Workarounds

Restrict WordPress administrator access to dedicated management workstations that do not browse the general web
Deploy a Web Application Firewall (WAF) rule enforcing same-origin referrer checks on wp-admin POST requests targeting the plugin
Enforce short session lifetimes and require re-authentication for privileged administrative actions
Remove the plugin entirely if it is not actively required for site functionality

bash

# Configuration example: enforce SameSite cookies via WordPress hardening
# Add to wp-config.php to reduce CSRF exposure of session cookies
@ini_set('session.cookie_samesite', 'Strict');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');