CVE-2025-49856: Responsive Plus CSRF Vulnerability

CVE-2025-49856 Overview

CVE-2025-49856 is a Cross-Site Request Forgery (CSRF) vulnerability in the CyberChimps Responsive Plus WordPress plugin (responsive-add-ons). The flaw affects all versions of Responsive Plus up to and including 3.2.2. An attacker can trick an authenticated administrator into submitting forged requests that alter plugin settings without consent. The issue is tracked under CWE-352 and is documented in the Patchstack Vulnerability Report. Exploitation requires user interaction, such as clicking a malicious link while authenticated to WordPress.

Critical Impact
A successful attack allows unauthorized modification of Responsive Plus plugin settings on a targeted WordPress site through a forged administrator request.

Affected Products

CyberChimps Responsive Plus (responsive-add-ons) WordPress plugin
All versions from n/a through 3.2.2
WordPress installations with the plugin active

Discovery Timeline

2025-06-17 - CVE-2025-49856 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49856

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens on state-changing requests handled by the Responsive Plus plugin. State-changing endpoints in the plugin accept requests without verifying that the request originated from a legitimate administrative session. An attacker who lures an authenticated WordPress administrator to a malicious page can cause the browser to submit a crafted request that modifies plugin settings.

The EPSS score is 0.121%, indicating a low probability of near-term exploitation observed in the wild. However, CSRF attacks against WordPress plugins remain a common initial vector for administrative tampering. There is no public exploit code and no listing on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence of proper CSRF protection [CWE-352] on settings-modifying handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives, but the affected plugin code paths do not validate nonces before applying settings changes. Any authenticated session cookie is treated as sufficient authorization.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a page containing a hidden form or auto-submitting JavaScript that targets the vulnerable plugin endpoint. When a logged-in administrator visits the attacker-controlled page, the browser attaches valid WordPress session cookies to the forged request, and the plugin processes the settings change as if it were legitimate. The confidentiality impact is none, integrity impact is low, and availability impact is none.

See the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2025-49856

Indicators of Compromise

Unexpected changes to Responsive Plus plugin settings in the WordPress admin dashboard.
HTTP POST requests to plugin admin endpoints with Referer headers pointing to external, untrusted domains.
Administrator account activity from unusual IP addresses or user agents shortly before settings changes.

Detection Strategies

Review WordPress audit logs for plugin setting modifications that lack a corresponding admin session context.
Inspect web server access logs for POST requests to responsive-add-ons admin endpoints without valid _wpnonce parameters.
Correlate administrator browsing activity with settings changes to identify requests triggered by external referrers.

Monitoring Recommendations

Enable a WordPress activity log plugin that records administrative changes and referrer metadata.
Alert on any modification to plugin configuration outside of scheduled maintenance windows.
Monitor outbound network requests from administrator workstations for connections to known malicious CSRF staging domains.

How to Mitigate CVE-2025-49856

Immediate Actions Required

Update the Responsive Plus plugin to a version later than 3.2.2 once released by CyberChimps.
Restrict WordPress administrator sessions using session timeouts and re-authentication for sensitive actions.
Require administrators to log out of WordPress before browsing untrusted sites, or use a dedicated browser profile for admin work.

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to 3.2.2 as affected. Site operators should monitor the plugin's official update channel and apply the vendor-supplied patch as soon as it becomes available.

Workarounds

Deactivate the Responsive Plus plugin until a patched version is installed if the functionality is not essential.
Deploy a Web Application Firewall (WAF) rule that enforces SameSite=Lax or SameSite=Strict cookies and validates the Referer header on WordPress admin POST requests.
Limit administrator access to trusted IP ranges using server-level access controls on /wp-admin/.

bash

# Example Apache configuration to restrict wp-admin by source IP
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
</Directory>