CVE-2025-57893: WP Fast Total Search CSRF Vulnerability

CVE-2025-57893 Overview

CVE-2025-57893 is a Cross-Site Request Forgery (CSRF) vulnerability in the Epsiloncool WP Fast Total Search WordPress plugin (fulltext-search). The flaw affects all versions up to and including 1.79.270. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unintended state-changing actions in the plugin. Exploitation requires user interaction but no privileges on the target site. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can trick an authenticated WordPress user into submitting forged requests to the WP Fast Total Search plugin, resulting in limited integrity impact on plugin data or configuration.

Affected Products

Epsiloncool WP Fast Total Search (fulltext-search) WordPress plugin
All versions from unspecified initial release through 1.79.270
WordPress sites with the plugin installed and active

Discovery Timeline

2025-08-22 - CVE-2025-57893 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57893

Vulnerability Analysis

The vulnerability stems from missing or improperly implemented anti-CSRF protections in the WP Fast Total Search plugin. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) to bind sensitive requests to a specific user session. When plugin endpoints accept state-changing requests without validating a nonce or verifying request origin, an attacker can craft off-site HTML that issues the same request from the victim's browser. The browser automatically attaches the victim's authentication cookies, and the plugin processes the request as legitimate.

Exploitation requires the victim to be logged into the target WordPress site and to visit an attacker-controlled page or click a crafted link. The impact is limited to integrity, with no direct confidentiality or availability effect according to the CVSS vector.

Root Cause

The root cause is the absence of adequate request origin verification on one or more plugin request handlers. Specifically, the plugin does not enforce WordPress nonce validation or equivalent CSRF token checks before executing sensitive operations. This maps directly to CWE-352.

Attack Vector

The attack proceeds over the network and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or embedded request targeting the vulnerable plugin endpoint. When an authenticated administrator or privileged user visits the page, the browser transmits the forged request with valid session cookies. The plugin processes the action, altering plugin data or settings within the scope of the victim's privileges. Technical details are available in the Patchstack CSRF Vulnerability Report.

Detection Methods for CVE-2025-57893

Indicators of Compromise

Unexpected changes to WP Fast Total Search plugin configuration or index data
WordPress access logs showing plugin action requests with external Referer headers or missing Referer values
Administrator sessions immediately preceded by visits to unfamiliar external URLs

Detection Strategies

Review web server access logs for POST or GET requests to fulltext-search plugin endpoints originating from cross-origin referrers
Audit WordPress activity logs for plugin setting modifications not tied to a legitimate admin session
Correlate browser history or proxy logs of privileged users with timestamps of plugin state changes

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule set that flags requests to plugin endpoints missing valid WordPress nonce parameters
Enable WordPress audit logging plugins to capture setting changes with user, IP, and referer context
Monitor administrator account activity for anomalous action sequences triggered shortly after external site visits

How to Mitigate CVE-2025-57893

Immediate Actions Required

Identify all WordPress sites running the WP Fast Total Search (fulltext-search) plugin at version 1.79.270 or earlier
Update the plugin to a fixed version once released by the vendor, or deactivate and remove it if no patch is available
Instruct administrators to log out of WordPress before browsing untrusted sites and to use separate browser profiles for admin work

Patch Information

At the time of publication, the vulnerability affects all versions of WP Fast Total Search up to and including 1.79.270. Consult the Patchstack advisory for the latest fixed version and vendor guidance.

Workarounds

Deactivate the WP Fast Total Search plugin until an updated version is installed
Restrict WordPress administrator access to trusted network segments using IP allowlisting at the web server or WAF
Configure the browser or reverse proxy to enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-site request delivery

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate fulltext-search
wp plugin list --name=fulltext-search --fields=name,status,version