CVE-2025-49967 Overview
CVE-2025-49967 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the marcusjansen Live Sports Streamthunder WordPress plugin. The issue impacts all versions up to and including 2.1. The flaw is categorized under [CWE-352] and stems from missing anti-CSRF protections on state-changing plugin actions.
An unauthenticated attacker can craft a malicious page that, when visited by an authenticated site administrator, triggers unintended actions in the plugin. Exploitation requires user interaction and produces a limited integrity impact with no confidentiality or availability impact.
Critical Impact
Successful exploitation lets an attacker perform plugin actions on behalf of an authenticated administrator, altering plugin state without consent.
Affected Products
- Live Sports Streamthunder WordPress plugin (live-sports-streamthunder) versions up to and including 2.1
- Vendor: marcusjansen
- WordPress installations with the vulnerable plugin activated
Discovery Timeline
- 2025-06-20 - CVE-2025-49967 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49967
Vulnerability Analysis
The vulnerability arises because the plugin processes state-changing HTTP requests without validating a WordPress nonce or another anti-CSRF token. Requests that modify plugin configuration or trigger administrative actions rely only on the user's active session cookie for authorization.
An attacker hosts a page containing an automatically submitted form or image tag targeting a vulnerable endpoint. When an authenticated administrator visits the attacker's page, the browser attaches the WordPress session cookie to the outbound request. The plugin accepts the forged request as legitimate.
The scope is limited to actions the plugin exposes to administrators. The advisory scores the impact as low integrity only, with no direct data exposure or service disruption.
Root Cause
The root cause is missing CSRF protection [CWE-352] on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() helpers for this purpose, but the affected code paths do not invoke them before executing sensitive operations.
Attack Vector
The attack is delivered over the network and requires user interaction from an authenticated administrator. The attacker cannot exploit the flaw directly against the server. Instead, the attacker must lure a logged-in administrator to a controlled page, typically through phishing or a malicious link on a third-party site. Once the administrator loads the page, the browser silently issues the forged request to the WordPress instance.
No verified public exploit code is available. Technical details are documented in the Patchstack Vulnerability Advisory.
Detection Methods for CVE-2025-49967
Indicators of Compromise
- Unexpected changes to Live Sports Streamthunder plugin settings without a corresponding administrator action in the audit trail.
- HTTP POST requests to plugin endpoints under /wp-admin/ with Referer headers pointing to external, untrusted domains.
- Administrator sessions producing plugin configuration changes shortly after clicking external links or visiting untrusted sites.
Detection Strategies
- Inspect web server access logs for requests to Live Sports Streamthunder admin actions that lack a same-origin Referer header.
- Alert on plugin option changes recorded in the wp_options table when no matching authenticated admin activity exists in application logs.
- Deploy a Web Application Firewall (WAF) rule to flag cross-origin requests targeting plugin admin endpoints.
Monitoring Recommendations
- Enable WordPress audit logging to record all administrator-level configuration changes with timestamps and source IP addresses.
- Correlate administrator browsing telemetry with plugin state changes to identify forged request patterns.
- Monitor for new or modified administrator accounts following unusual outbound web traffic from admin workstations.
How to Mitigate CVE-2025-49967
Immediate Actions Required
- Deactivate the Live Sports Streamthunder plugin until a patched version is available from the vendor.
- Restrict WordPress administrator access to dedicated browsers or workstations that do not browse untrusted sites.
- Enforce short session lifetimes and require re-authentication for administrative actions.
Patch Information
No fixed version is listed in the advisory at the time of publication. All versions up to and including 2.1 are affected. Consult the Patchstack Vulnerability Advisory for the latest remediation status and vendor updates.
Workarounds
- Remove or disable the live-sports-streamthunder plugin until the vendor publishes a fix that adds nonce validation.
- Deploy WAF rules that block cross-origin POST requests to WordPress admin endpoints associated with the plugin.
- Require administrators to log out of WordPress before browsing external sites and enforce SameSite=Strict cookies where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
