CVE-2025-58687: Current Age Plugin CSRF Vulnerability

CVE-2025-58687 Overview

CVE-2025-58687 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the WP CMS Ninja Current Age Plugin for WordPress. The flaw affects all versions up to and including 1.6. An attacker can chain the CSRF weakness with Stored Cross-Site Scripting (XSS), persisting malicious JavaScript into the plugin's settings when a privileged user is tricked into loading a crafted page. The injected payload executes in the browsers of subsequent site visitors and administrators, enabling session theft, administrative action abuse, and further compromise of the WordPress site.

Critical Impact

A successful attack stores attacker-controlled JavaScript in the WordPress site through forged administrator requests, leading to scope-changed code execution in trusted browser contexts.

Affected Products

• WP CMS Ninja Current Age Plugin (current-age) for WordPress
• All versions from initial release through 1.6
• WordPress sites running the plugin with authenticated administrator sessions

Discovery Timeline

• 2025-09-22 - CVE-2025-58687 published to the National Vulnerability Database
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-58687

Vulnerability Analysis

The Current Age Plugin exposes administrative actions that update plugin configuration without validating the origin of the incoming request. The plugin does not enforce WordPress nonce checks (wp_verify_nonce) or equivalent anti-CSRF tokens on state-changing endpoints. An attacker hosts a malicious page that submits a forged POST request to the plugin's settings handler. When an authenticated administrator visits the page, the browser automatically sends valid session cookies with the request.

The forged request writes attacker-supplied input into a plugin field that is later rendered without proper output encoding. This stored payload introduces a persistent XSS sink. Every administrator or visitor who renders the affected page executes the attacker's JavaScript in the site's origin. The combination of missing CSRF protection and missing output sanitization elevates a single user-interaction event into site-wide stored XSS.

Root Cause

The root cause is two compounded flaws. First, the plugin omits CSRF token validation on privileged write operations, violating the WordPress security model that requires nonces on administrative actions. Second, user-controlled input written through those operations is reflected back into rendered HTML without contextual escaping. Either flaw alone is exploitable, and together they enable persistent script injection through forged requests.

Attack Vector

The attack requires no authentication on the attacker side but does require user interaction from a logged-in administrator. The attacker delivers a crafted link or embedded page through phishing, a comment field, or a third-party site. When the administrator loads the page, a hidden form or fetch request targets the vulnerable plugin endpoint and submits malicious content. The payload is stored in the plugin's options table and rendered on subsequent page loads, executing JavaScript in the browser of any user viewing the affected output. Refer to the Patchstack advisory for endpoint-level technical details.

Detection Methods for CVE-2025-58687

Indicators of Compromise

• Unexpected <script> tags, onerror handlers, or javascript: URIs stored in the wp_options rows associated with the current-age plugin
• HTTP POST requests to plugin administrative endpoints lacking a valid _wpnonce parameter or Referer header matching the site origin
• Outbound requests from administrator browsers to unfamiliar domains shortly after visiting external links
• New or modified WordPress administrator accounts created without a corresponding audit trail

Detection Strategies

• Audit the WordPress database for HTML or script content inside Current Age Plugin option keys
• Inspect web server access logs for POST requests to /wp-admin/admin.php or /wp-admin/options-general.php referencing the current-age plugin with external Referer headers
• Deploy a web application firewall rule that blocks form submissions to plugin endpoints when the Origin header does not match the site
• Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages rendering plugin output

Monitoring Recommendations

• Enable WordPress activity logging to capture changes to plugin settings and the identity of the acting user
• Forward web server, WAF, and WordPress audit logs to a centralized SIEM or data lake for correlation across administrator sessions
• Alert on stored content containing script tags, event handlers, or encoded payloads in plugin-managed fields

How to Mitigate CVE-2025-58687

Immediate Actions Required

• Deactivate the WP CMS Ninja Current Age Plugin until a patched version is confirmed available from the vendor
• Review and sanitize all values stored by the plugin in wp_options, removing any HTML, script tags, or encoded payloads
• Force a password reset for all WordPress administrators and invalidate active sessions to revoke any stolen credentials
• Restrict administrator browsing habits and require administrators to use a dedicated browser profile for WordPress management

Patch Information

At the time of publication, no fixed version is listed beyond 1.6 in the Patchstack advisory. Site administrators should monitor the plugin's repository for a release that adds wp_verify_nonce validation and proper output escaping. Until a patch ships, removal of the plugin is the most reliable remediation.

Workarounds

• Remove the plugin from the WordPress installation if Current Age functionality is not business-critical
• Deploy a web application firewall rule that blocks POST requests to plugin endpoints lacking a valid same-origin Referer and Origin header
• Apply a Content Security Policy that disallows inline scripts on pages where plugin output is rendered
• Limit administrator accounts to the minimum required and require multi-factor authentication on all privileged WordPress logins

# Example WordPress CLI commands to disable the plugin and audit options
wp plugin deactivate current-age
wp plugin delete current-age
wp option list --search='*current_age*' --format=table