CVE-2025-54675 Overview
CVE-2025-54675 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the YITH WooCommerce Popup plugin developed by YITHEMES for WordPress. The flaw exists in all plugin versions up to and including 1.48.0. An attacker can trick an authenticated administrator into submitting a forged request that performs unintended state-changing actions within the plugin. The vulnerability is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, such as clicking a malicious link while authenticated to the target WordPress site.
Critical Impact
A successful CSRF attack against an authenticated WordPress administrator can lead to unauthorized modification of plugin settings on sites running YITH WooCommerce Popup through 1.48.0.
Affected Products
- YITHEMES YITH WooCommerce Popup plugin for WordPress
- Versions from n/a through 1.48.0
- WordPress sites with the yith-woocommerce-popup plugin installed and active
Discovery Timeline
- 2025-08-14 - CVE-2025-54675 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54675
Vulnerability Analysis
The vulnerability stems from missing or improperly implemented anti-CSRF protections in the YITH WooCommerce Popup plugin. WordPress plugins typically validate state-changing requests using nonces generated by wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). When these controls are absent or misapplied, the plugin cannot distinguish between a legitimate administrator action and a forged request originating from an attacker-controlled page.
An attacker crafts a malicious web page containing an HTML form or JavaScript that submits a request to the vulnerable plugin endpoint. If a logged-in WordPress administrator visits the attacker's page, the browser automatically attaches the session cookies. The plugin processes the request as if it were legitimate, resulting in unauthorized configuration changes.
The CVSS vector indicates that only integrity is affected, with no direct impact on confidentiality or availability. Refer to the Patchstack CSRF Vulnerability Report for advisory details.
Root Cause
The root cause is the absence of proper CSRF token validation on one or more privileged actions exposed by the plugin. Without a nonce check tied to the current user session, the plugin accepts any authenticated request regardless of its origin.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker must lure an authenticated site administrator to a malicious URL or page. The attack succeeds silently once the victim's browser issues the forged request to the WordPress admin endpoint.
No verified public proof-of-concept code is available. See the Patchstack advisory for further technical context.
Detection Methods for CVE-2025-54675
Indicators of Compromise
- Unexpected changes to YITH WooCommerce Popup plugin configuration or popup content that administrators did not initiate.
- WordPress access logs showing POST requests to plugin admin endpoints with Referer headers pointing to external, untrusted domains.
- Administrator sessions performing plugin state changes immediately after visiting external links.
Detection Strategies
- Inventory WordPress installations and identify any site running yith-woocommerce-popup at version 1.48.0 or earlier.
- Review WordPress audit logs for plugin option updates that lack a corresponding administrator UI action.
- Correlate outbound browsing activity from administrator workstations with subsequent WordPress configuration changes.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture option changes, plugin setting updates, and administrative POST requests.
- Monitor web server logs for requests to /wp-admin/admin.php or admin-ajax.php containing plugin-specific action parameters and suspicious Referer values.
- Alert on plugin configuration modifications outside change windows or from administrator accounts that did not authenticate through the WordPress dashboard.
How to Mitigate CVE-2025-54675
Immediate Actions Required
- Identify all WordPress sites running YITH WooCommerce Popup at version 1.48.0 or earlier.
- Update the plugin to a version above 1.48.0 once the vendor publishes a fixed release.
- Restrict administrator browsing habits and require dedicated administrative browser profiles that do not visit untrusted sites.
Patch Information
The vulnerability affects YITH WooCommerce Popup up to and including 1.48.0. Administrators should consult the Patchstack CSRF Vulnerability Report and the YITHEMES plugin changelog to confirm the fixed version and apply the update through the WordPress plugin manager.
Workarounds
- Deactivate the YITH WooCommerce Popup plugin until a patched version is available and installed.
- Deploy a web application firewall rule that enforces same-origin Referer and Origin header validation for POST requests to WordPress admin endpoints.
- Require administrators to log out of WordPress sessions before browsing untrusted content and use browser isolation for administrative activity.
# Example WordPress CLI check for affected plugin version
wp plugin get yith-woocommerce-popup --field=version
wp plugin update yith-woocommerce-popup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
