CVE-2025-52791: Knowledge Base Maker CSRF Vulnerability

CVE-2025-52791 Overview

CVE-2025-52791 is a Cross-Site Request Forgery (CSRF) vulnerability in the devfelixmoira Knowledge Base – Knowledge Base Maker plugin for WordPress. The flaw affects all versions through 1.1.8 and enables attackers to chain CSRF with Stored Cross-Site Scripting (XSS). An attacker tricks an authenticated administrator into submitting a forged request that injects persistent JavaScript into knowledge base content. The vulnerability maps to CWE-352 and requires user interaction to succeed. Exploitation occurs over the network with low attack complexity and no privileges required from the attacker.

Critical Impact
A successful attack stores attacker-controlled scripts that execute in the browsers of subsequent site visitors, including administrators, enabling session theft and further site compromise.

Affected Products

Knowledge Base – Knowledge Base Maker plugin for WordPress (knowledge-base-maker)
All versions from initial release through 1.1.8
WordPress sites where the plugin is installed and active

Discovery Timeline

2025-06-20 - CVE-2025-52791 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-52791

Vulnerability Analysis

The plugin processes state-changing requests without validating an anti-CSRF token. An authenticated administrator who visits an attacker-controlled page can be coerced into submitting a forged request to the plugin. The forged request writes attacker-supplied content into a stored field that is later rendered without sufficient output encoding.

Because the injected payload persists in the database, every subsequent visitor who loads the affected knowledge base page executes the script in their browser session. The chained outcome combines CSRF with Stored XSS, producing impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing or improperly implemented CSRF protection on plugin endpoints that accept user-controlled input. WordPress provides the wp_nonce_field() and check_admin_referer() APIs to mitigate this class of issue, but the affected handlers did not enforce nonce validation. Combined with insufficient sanitization of stored content, this allows persistent script injection through forged requests.

Attack Vector

The attack proceeds over the network and requires user interaction. The attacker hosts a page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser sends the request along with valid session cookies. The plugin processes the request and stores the malicious payload. Any visitor who later renders the affected knowledge base entry executes the injected JavaScript. See the Patchstack CSRF Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-52791

Indicators of Compromise

Unexpected <script> tags, event handlers, or obfuscated JavaScript stored in knowledge base entries created or modified by the plugin.
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
New or modified administrator accounts following an administrator visit to an unfamiliar external site.

Detection Strategies

Audit the WordPress database for knowledge base content containing HTML tags, JavaScript keywords, or encoded payloads such as onerror=, javascript:, or String.fromCharCode.
Review web server logs for POST requests to knowledge-base-maker endpoints lacking a same-origin Referer header.
Inspect rendered knowledge base pages in a sandboxed browser and monitor outbound network requests for unexpected callbacks.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/plugins/knowledge-base-maker/ directory.
Forward WordPress audit and access logs to a SIEM and alert on administrator-initiated content changes following cross-origin requests.
Monitor outbound traffic from visitor sessions for connections to known credential-harvesting or malware command-and-control infrastructure.

How to Mitigate CVE-2025-52791

Immediate Actions Required

Update the Knowledge Base – Knowledge Base Maker plugin to a version later than 1.1.8 once the vendor publishes a fix.
If no patched version is available, deactivate and remove the plugin from production WordPress sites.
Audit knowledge base content and remove any unexpected HTML or JavaScript payloads, then rotate administrator credentials and session tokens.

Patch Information

At the time of NVD publication, the vulnerability affects versions through 1.1.8. Refer to the Patchstack CSRF Vulnerability Report and the official WordPress plugin repository for the latest available release and remediation guidance.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to knowledge-base-maker plugin endpoints.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on pages rendering knowledge base content.
Require administrators to use a dedicated browser profile for WordPress administration and avoid browsing untrusted sites in the same session.

bash

# Example nginx rule to block cross-origin POSTs to the plugin endpoint
location ~* /wp-admin/admin\.php {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-wordpress-site\.com/") {
            return 403;
        }
    }
}