CVE-2025-58798: BCM Duplicate Menu CSRF Vulnerability

CVE-2025-58798 Overview

CVE-2025-58798 is a Cross-Site Request Forgery (CSRF) vulnerability in the BCM Duplicate Menu WordPress plugin developed by Bjorn Manintveld. The flaw affects all versions of the plugin up to and including 1.1.3. An attacker can craft a malicious web page that, when visited by an authenticated WordPress administrator, triggers unintended state-changing actions within the plugin. The weakness is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, and the impact is limited to integrity of the menu data managed by the plugin.

Critical Impact
An authenticated administrator can be tricked into duplicating or altering WordPress menus through a forged request, resulting in unauthorized modifications to site navigation content.

Affected Products

Bjorn Manintveld BCM Duplicate Menu plugin for WordPress
All versions from n/a through 1.1.3
WordPress installations with the bcm-duplicate-menu plugin enabled

Discovery Timeline

2025-09-05 - CVE-2025-58798 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58798

Vulnerability Analysis

The BCM Duplicate Menu plugin performs state-changing operations without validating that the incoming request originated from an authenticated user session within the WordPress administrative interface. WordPress provides a standard nonce mechanism (wp_nonce_field, check_admin_referer, and wp_verify_nonce) to protect administrative actions from forged requests. The plugin fails to implement or correctly validate this token on its menu duplication endpoint.

An attacker exploits this by hosting a page containing a hidden form or automated request targeting the vulnerable action. When a logged-in administrator visits the attacker-controlled page, the browser transmits the administrator's session cookies alongside the forged request. The plugin then processes the request as legitimate. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.131%, reflecting the requirement for administrator interaction.

Root Cause

The root cause is missing or insufficient CSRF token validation on privileged plugin endpoints. Without a per-request nonce tied to the user session, the plugin cannot distinguish between a request initiated by the administrator inside the WordPress dashboard and one triggered from a third-party origin.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must convince an authenticated WordPress administrator to visit a malicious URL or load attacker-controlled content, typically via phishing email, malicious advertisement, or a compromised website. The forged request executes with the administrator's privileges but only affects the integrity of menu data. Confidentiality and availability are not impacted.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-58798

Indicators of Compromise

Unexpected duplicate WordPress navigation menus appearing in the administrative dashboard.
HTTP POST requests to bcm-duplicate-menu plugin endpoints with Referer headers pointing to external, non-WordPress domains.
WordPress admin activity logs showing menu duplication events without corresponding administrator-initiated sessions in dashboard access logs.

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin.php or admin-post.php referencing the bcm-duplicate-menu action with foreign or absent Referer headers.
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to WordPress plugin endpoints lacking a valid _wpnonce parameter.
Correlate administrator browser activity with plugin write operations to identify requests generated outside authenticated dashboard sessions.

Monitoring Recommendations

Enable WordPress activity logging plugins to track menu creation and modification events with source IP and user agent metadata.
Monitor outbound traffic from administrator workstations for connections to newly registered or low-reputation domains that may host CSRF payloads.
Alert on anomalous spikes in menu-related database writes within wp_term_taxonomy and wp_posts tables where post_type = 'nav_menu_item'.

How to Mitigate CVE-2025-58798

Immediate Actions Required

Update the BCM Duplicate Menu plugin to a version later than 1.1.3 once the vendor releases a patched build.
Deactivate and remove the bcm-duplicate-menu plugin from any WordPress installation where an updated version is not yet available.
Require administrators to log out of the WordPress dashboard when performing unrelated browsing to reduce CSRF exposure.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.1.3. Administrators should consult the Patchstack Vulnerability Report for current patch status and apply any vendor-released update immediately.

Workarounds

Restrict access to /wp-admin/ by source IP using web server or reverse proxy rules to reduce the attack surface for administrator-targeted CSRF.
Enforce SameSite=Strict or SameSite=Lax attributes on WordPress authentication cookies to block cross-origin cookie transmission.
Deploy a virtual patch through a WAF that enforces the presence and validity of a WordPress nonce on requests targeting the vulnerable plugin action.

bash

# Example NGINX configuration to restrict WordPress admin access by IP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # Trusted admin network
    deny  all;
    try_files $uri $uri/ /index.php?$args;
}