CVE-2025-58219 Overview
CVE-2025-58219 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LIJE Show Pages List WordPress plugin (show-pages-list). The flaw impacts all versions up to and including 1.2.0. An attacker can trick an authenticated user into submitting an unintended request that alters plugin state. The issue is tracked under CWE-352 and was published to the National Vulnerability Database (NVD) on September 22, 2025.
Critical Impact
Successful exploitation requires user interaction, but a crafted link or page can cause authenticated administrators to perform unintended plugin actions, resulting in limited integrity impact on affected WordPress sites.
Affected Products
- LIJE Show Pages List plugin for WordPress
- All versions up to and including 1.2.0
- WordPress sites running the vulnerable show-pages-list plugin
Discovery Timeline
- 2025-09-22 - CVE-2025-58219 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58219
Vulnerability Analysis
The vulnerability stems from missing anti-CSRF protections in the Show Pages List plugin. The plugin does not validate the origin or authenticity of state-changing HTTP requests. WordPress provides nonce tokens through wp_nonce_field() and check_admin_referer(), but the affected handlers omit these checks. An attacker can host a malicious page that issues a forged request to the target WordPress site. If an authenticated administrator visits the page, the browser sends the request with valid session cookies. The server then processes the action as if it originated from a legitimate admin workflow.
Root Cause
The root cause is the absence of nonce verification on plugin form submissions or AJAX endpoints. The handler code accepts POST or GET parameters and applies changes without confirming intent through a WordPress nonce or SameSite cookie enforcement. This aligns with CWE-352: Cross-Site Request Forgery.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker crafts an HTML page containing an auto-submitting form or image tag targeting the plugin endpoint. The attacker then delivers the link through phishing, forum posts, or malicious advertisements. When an authenticated WordPress user with sufficient privileges loads the page, the browser transmits authenticated cookies to the vulnerable endpoint. The plugin executes the request, producing limited integrity impact on the affected site. See the Patchstack Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-58219
Indicators of Compromise
- Unexpected changes to Show Pages List plugin settings or configuration options within wp-admin.
- HTTP referrer headers on plugin state-changing requests pointing to external, untrusted domains.
- Administrator-initiated POST requests to plugin endpoints lacking a valid _wpnonce parameter.
Detection Strategies
- Review web server access logs for POST requests to plugin action URLs originating from external referrers.
- Audit WordPress activity logs for administrative configuration changes that do not correlate with legitimate admin sessions.
- Correlate browser session activity with cross-origin requests targeting admin-ajax.php or plugin-specific handlers.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture plugin option changes and administrative actions.
- Monitor for phishing campaigns targeting site administrators with links to attacker-controlled pages.
- Alert on outbound referrers in access logs where authenticated admin actions originate from third-party domains.
How to Mitigate CVE-2025-58219
Immediate Actions Required
- Deactivate the LIJE Show Pages List plugin until a patched version is released and verified.
- Limit administrator browsing sessions to trusted sites and use a dedicated browser profile for WordPress administration.
- Enforce strong session management, including short session lifetimes and re-authentication for sensitive actions.
Patch Information
At the time of publication, no vendor patch is listed in the NVD entry for versions above 1.2.0. Site owners should monitor the Patchstack advisory and the plugin repository for an updated release that adds nonce validation.
Workarounds
- Remove or deactivate the show-pages-list plugin if it is not business-critical.
- Deploy a web application firewall (WAF) with rules that block cross-origin POST requests to WordPress admin endpoints.
- Configure the site to enforce SameSite=Lax or SameSite=Strict cookie attributes on authentication cookies where compatible.
# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate show-pages-list
# Optionally remove the plugin entirely
wp plugin uninstall show-pages-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
