CVE-2025-58200: Flexible FAQ Plugin CSRF Vulnerability

CVE-2025-58200 Overview

CVE-2025-58200 is a Cross-Site Request Forgery (CSRF) vulnerability in the Bage Flexible FAQ WordPress plugin. The flaw affects all versions of flexible-faq up to and including version 0.2. An attacker can craft a malicious web page that, when visited by an authenticated site administrator, triggers unauthorized state-changing actions in the plugin without the victim's consent.

The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically by luring an authenticated user to click a crafted link or load an attacker-controlled page.

Critical Impact
Attackers can force authenticated WordPress administrators to perform unintended actions in the Flexible FAQ plugin, resulting in unauthorized integrity changes to FAQ content.

Affected Products

Bage Flexible FAQ plugin for WordPress
Flexible FAQ versions from n/a through 0.2
WordPress installations with the flexible-faq plugin enabled

Discovery Timeline

2025-09-22 - CVE CVE-2025-58200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58200

Vulnerability Analysis

The Flexible FAQ plugin fails to validate the origin of state-changing HTTP requests. WordPress provides built-in nonce mechanisms through wp_nonce_field() and check_admin_referer() to prevent CSRF, but the affected plugin versions do not enforce these checks on sensitive endpoints.

An attacker who convinces an authenticated administrator to visit a malicious page can trigger requests that execute plugin functionality in the victim's session. The browser automatically includes valid WordPress authentication cookies with the forged request, allowing the action to succeed.

The impact is limited to integrity changes within the plugin scope. Confidentiality and availability are not directly affected based on the assessed CVSS vector.

Root Cause

The root cause is the absence of anti-CSRF tokens on privileged actions exposed by the plugin. Requests that modify plugin state accept cookie-based authentication without verifying a _wpnonce value or checking the HTTP Referer header.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that submits a request to the vulnerable WordPress endpoint. When a logged-in administrator visits that page, the browser transmits authentication cookies and the plugin processes the forged request as legitimate. Refer to the Patchstack advisory for endpoint-level details.

Detection Methods for CVE-2025-58200

Indicators of Compromise

Unexpected modifications to FAQ entries, categories, or plugin settings in the WordPress admin panel.
Web server access logs showing POST requests to flexible-faq admin endpoints with external Referer headers.
Administrator sessions performing plugin actions immediately after visiting untrusted external sites.

Detection Strategies

Inspect WordPress audit logs for plugin configuration changes that do not correlate with administrator activity.
Correlate browser history or proxy logs of admin users with timestamps of plugin state changes.
Deploy a web application firewall (WAF) rule that flags POST requests to wp-admin endpoints lacking a same-origin Referer.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record all administrative actions with source IP and referrer.
Alert on any FAQ plugin endpoint invocation from unexpected referrers or user agents.
Review administrator account activity daily for unauthorized content changes.

How to Mitigate CVE-2025-58200

Immediate Actions Required

Deactivate and remove the flexible-faq plugin until a patched release is confirmed available.
Restrict wp-admin access to trusted IP ranges via web server or WAF rules.
Instruct administrators to log out of WordPress before browsing untrusted sites.

Patch Information

No vendor-supplied patched version is identified in the enriched CVE data. All versions through 0.2 are affected. Monitor the Patchstack advisory for updates on a fixed release.

Workarounds

Replace Flexible FAQ with an actively maintained FAQ plugin that implements WordPress nonce verification.
Enforce two-factor authentication for all administrator accounts to reduce the impact of forged requests.
Configure the browser or WordPress to use SameSite=Strict session cookies where feasible.
Apply a WAF rule that blocks state-changing requests to plugin endpoints without a valid _wpnonce parameter.

bash

# Example WAF rule concept: block POSTs to flexible-faq endpoints missing _wpnonce
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1005820,msg:'Flexible FAQ CSRF protection'"
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=flexible-faq" \
  "chain"
SecRule &ARGS:_wpnonce "@eq 0"