CVE-2025-57918: LinkedInclude CSRF Vulnerability

CVE-2025-57918 Overview

CVE-2025-57918 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the ERA404 LinkedInclude WordPress plugin. The flaw affects all versions up to and including 3.0.4. An attacker can chain the CSRF weakness with a stored Cross-Site Scripting (XSS) payload, persisting attacker-controlled script content inside the affected WordPress site.

Exploitation requires a logged-in administrator to visit an attacker-crafted page. The attacker uses the victim's authenticated session to submit a forged request that stores malicious JavaScript. Subsequent visitors then execute the injected payload in their browser context.

Critical Impact
Successful exploitation results in stored XSS within WordPress sites running LinkedInclude, enabling session theft, administrative action hijacking, and persistent client-side compromise across all visitors.

Affected Products

ERA404 LinkedInclude WordPress plugin versions through 3.0.4
WordPress installations with the linkedinclude plugin enabled
Any WordPress site exposing the vulnerable plugin endpoints to authenticated administrators

Discovery Timeline

2025-09-22 - CVE-2025-57918 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-57918

Vulnerability Analysis

The LinkedInclude plugin exposes state-changing actions without verifying request origin. The plugin omits or improperly validates WordPress nonces (wp_nonce_field / check_admin_referer) on settings update handlers. An attacker hosts a malicious page that auto-submits a forged POST request to the plugin's configuration endpoint.

When an authenticated administrator visits the attacker's page, the browser attaches valid WordPress session cookies. The forged request stores attacker-controlled HTML or JavaScript in plugin-managed fields. Because the plugin also fails to sanitize stored input, the payload renders verbatim when the page is later viewed, producing stored XSS.

The attack scope is changed because injected JavaScript executes in the browser of any user visiting the affected page, not only the administrator who submitted the request. This allows lateral compromise of visitor sessions and pivoting to additional administrative actions.

Root Cause

The root cause is missing or insufficient CSRF protection [CWE-352] on plugin actions that accept HTML-bearing input. The plugin neither enforces nonce validation nor applies output encoding on stored values, allowing forged authenticated requests to persist executable script.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must convince an authenticated WordPress administrator to load an attacker-controlled URL while their session is active. No credentials, prior access, or local foothold on the WordPress server are required.

No public proof-of-concept exploit code is currently available. Refer to the Patchstack WordPress Vulnerability Advisory for technical details.

Detection Methods for CVE-2025-57918

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) stored in LinkedInclude plugin configuration fields or post content
WordPress access logs showing POST requests to wp-admin/admin.php or plugin AJAX endpoints with Referer headers from external untrusted domains
New or modified plugin option rows in the wp_options table containing HTML or JavaScript payloads
Outbound browser requests from site visitors to attacker-controlled domains following page rendering

Detection Strategies

Inspect WordPress database wp_options and any LinkedInclude-specific tables for HTML markup or script tags in stored configuration values
Monitor web server logs for POST requests to plugin endpoints lacking a same-origin Referer header
Deploy Content Security Policy (CSP) reporting to capture script-source violations originating from injected payloads

Monitoring Recommendations

Enable WordPress audit logging to record plugin setting changes and the user account responsible
Alert on administrator sessions performing settings updates immediately after navigating to external URLs
Track plugin file integrity and configuration baselines to detect unauthorized modifications

How to Mitigate CVE-2025-57918

Immediate Actions Required

Identify all WordPress sites with the LinkedInclude plugin installed and confirm the installed version
Deactivate and remove the LinkedInclude plugin if a patched version is not yet available
Force a password rotation and session invalidation for all WordPress administrator accounts
Review stored plugin configuration and post content for injected scripts and remove malicious payloads

Patch Information

No fixed version has been published in the available advisory data. Versions through 3.0.4 are affected. Monitor the Patchstack WordPress Vulnerability Advisory for an updated release.

Workarounds

Restrict access to /wp-admin/ by source IP using web server access controls
Deploy a Web Application Firewall (WAF) rule blocking cross-origin POST requests to LinkedInclude endpoints
Enforce a strict Content Security Policy that disallows inline scripts on rendered pages
Require administrators to use a dedicated browser profile and log out immediately after administrative tasks

bash

# Example WAF rule snippet to block cross-origin POSTs to plugin endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "id:1057918,phase:1,deny,status:403,\
   chain,msg:'Block cross-origin POST to LinkedInclude plugin'"
  SecRule REQUEST_URI "@contains linkedinclude" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"