CVE-2025-58792: Authors List Plugin CSRF Vulnerability

CVE-2025-58792 Overview

CVE-2025-58792 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPKube Authors List plugin for WordPress. The flaw affects all versions up to and including 2.0.6.2. An attacker can trick an authenticated user into submitting a forged HTTP request that performs unintended state-changing actions in the plugin. The vulnerability requires user interaction and is exploitable over the network without authentication on the attacker side. Successful exploitation results in a limited integrity impact, with no direct impact on confidentiality or availability. The issue maps to CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can coerce a logged-in WordPress user into executing unauthorized actions in the Authors List plugin by loading an attacker-controlled page.

Affected Products

WPKube Authors List plugin for WordPress
Versions from n/a through 2.0.6.2
WordPress sites with the authors-list plugin installed and active

Discovery Timeline

2025-09-05 - CVE-2025-58792 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58792

Vulnerability Analysis

The Authors List plugin exposes one or more state-changing request handlers that do not verify the origin or intent of incoming requests. WordPress provides nonce tokens through wp_nonce_field() and check_admin_referer() to prevent CSRF, but the affected plugin fails to validate these tokens on sensitive endpoints. An attacker crafts a malicious HTML page containing a form or JavaScript that targets the vulnerable endpoint. When an authenticated WordPress user visits the attacker's page, the browser automatically sends the user's session cookies with the forged request. The server processes the request as legitimate because it originates from an authenticated session. The impact is limited to integrity changes within the plugin's scope, such as modifying plugin settings or author data.

Root Cause

The root cause is missing or improperly implemented anti-CSRF token validation on request handlers that alter server-side state. The plugin relies on session authentication alone, without verifying that the request originated from a trusted context.

Attack Vector

Exploitation requires a WordPress user with an active session to visit an attacker-controlled page or click a crafted link. The attacker hosts HTML that auto-submits a form or issues a fetch request to the vulnerable plugin endpoint. No credentials are needed by the attacker because the victim's browser attaches cookies automatically. See the Patchstack advisory for additional technical details.

Detection Methods for CVE-2025-58792

Indicators of Compromise

Unexpected modifications to Authors List plugin settings or author records without a corresponding administrative action in audit logs
HTTP POST requests to authors-list plugin endpoints containing a Referer header pointing to an external, untrusted domain
Sudden configuration changes coinciding with an administrator visiting external links or emails

Detection Strategies

Inspect WordPress access logs for POST requests to wp-admin/admin.php or admin-ajax.php targeting authors-list actions with off-site or missing Referer headers
Correlate plugin setting changes with user browsing activity to identify requests triggered by external pages
Deploy a Web Application Firewall (WAF) rule that flags authenticated POST requests missing valid WordPress nonce parameters

Monitoring Recommendations

Enable WordPress activity logging plugins to record all administrative changes with source IP and referer data
Monitor for the plugin version 2.0.6.2 or earlier across managed WordPress installations
Alert on outbound emails or messages sent to administrators that link to unknown domains, which may be CSRF delivery vectors

How to Mitigate CVE-2025-58792

Immediate Actions Required

Update the WPKube Authors List plugin to a version later than 2.0.6.2 once a fixed release is available from the vendor
If no patched version is available, deactivate and remove the plugin until a fix is published
Instruct WordPress administrators to log out of the admin console when not actively working

Patch Information

At the time of the last NVD update, the advisory lists affected versions from n/a through 2.0.6.2. Review the Patchstack vulnerability entry for the latest fixed version information and vendor updates.

Workarounds

Deploy a WAF rule that blocks state-changing requests to authors-list endpoints lacking a valid WordPress nonce (_wpnonce) parameter
Enforce SameSite=Lax or SameSite=Strict on WordPress authentication cookies to reduce cross-origin cookie transmission
Restrict administrative access to the WordPress backend by IP allowlisting where feasible
Require administrators to use a dedicated browser profile for WordPress management to isolate sessions from general browsing

bash

# Example WAF rule concept (ModSecurity) to require a nonce on authors-list POSTs
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1058792,phase:2,deny,status:403,msg:'Missing WP nonce on authors-list request'"
SecRule REQUEST_URI "@contains authors-list" \
  "chain"
SecRule &ARGS:_wpnonce "@eq 0"