CVE-2025-58800: WP Email Template CSRF Vulnerability

CVE-2025-58800 Overview

CVE-2025-58800 is a Cross-Site Request Forgery (CSRF) vulnerability in the Steve Truman WP Email Template plugin for WordPress. The flaw affects all versions of the plugin up to and including 2.8.5. An attacker can craft a malicious web page that, when visited by an authenticated WordPress administrator, triggers unauthorized state-changing actions in the plugin. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed. Exploitation depends on tricking a logged-in privileged user into loading attacker-controlled content.

Critical Impact
Attackers can force authenticated WordPress administrators to submit unintended requests that modify WP Email Template plugin settings without their consent.

Affected Products

Steve Truman WP Email Template plugin for WordPress
All versions from n/a through 2.8.5
WordPress sites running the vulnerable wp-email-template plugin

Discovery Timeline

2025-09-05 - CVE-2025-58800 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58800

Vulnerability Analysis

The WP Email Template plugin processes state-changing requests without verifying the origin of those requests. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer() to prevent CSRF, but the affected plugin endpoints either omit these checks or implement them incorrectly. An attacker hosts a malicious page containing a forged form or JavaScript request targeting the plugin's administrative endpoints. When a logged-in WordPress administrator visits the page, the browser automatically attaches session cookies to the outbound request. The server then processes the forged request as if the administrator initiated it.

The impact is limited to integrity changes within the plugin's scope, such as modifying email templates or configuration values. Confidentiality and availability are not directly affected according to the published CVSS vector.

Root Cause

The root cause is missing or insufficient CSRF protection on administrative actions exposed by the WP Email Template plugin. The plugin does not validate a per-request anti-CSRF token before executing sensitive operations, violating the CWE-352 weakness pattern.

Attack Vector

Exploitation requires an authenticated WordPress administrator to visit an attacker-controlled URL or load attacker-controlled content while logged in. The attacker delivers the malicious payload through phishing emails, malicious advertisements, or compromised third-party websites. Once the victim loads the payload, the browser silently submits the forged request. See the Patchstack WordPress Vulnerability advisory for the disclosure details.

// No verified proof-of-concept code is publicly available.
// The vulnerability follows a standard CSRF pattern:
// an attacker hosts a page that auto-submits a forged POST
// to a WP Email Template admin endpoint while the victim
// is authenticated to WordPress.

Detection Methods for CVE-2025-58800

Indicators of Compromise

Unexpected modifications to WP Email Template plugin configuration or stored email templates.
WordPress access logs showing POST requests to plugin admin endpoints with Referer headers pointing to external domains.
Administrator sessions initiating plugin changes shortly after visiting untrusted external links.

Detection Strategies

Audit WordPress plugin settings and compare against known-good baselines to identify unauthorized changes.
Review web server access logs for POST requests to wp-admin endpoints associated with the wp-email-template plugin that lack a valid nonce parameter.
Correlate administrator browsing activity with configuration changes to detect requests originating from external referrers.

Monitoring Recommendations

Enable WordPress activity logging plugins to track configuration changes by user and timestamp.
Monitor outbound web traffic from administrator workstations for connections to suspicious domains preceding plugin changes.
Alert on anomalous administrative actions performed outside normal maintenance windows.

How to Mitigate CVE-2025-58800

Immediate Actions Required

Update the WP Email Template plugin to a version later than 2.8.5 once the vendor releases a patched build.
Restrict administrative access to trusted networks and enforce separate browsers or profiles for WordPress administration.
Require administrators to log out of WordPress before browsing untrusted sites.

Patch Information

At the time of publication, the vulnerability affects WP Email Template versions through 2.8.5. Review the Patchstack advisory for the latest fixed version information and apply the update through the WordPress plugin manager.

Workarounds

Deactivate and remove the WP Email Template plugin until a fixed version is installed.
Deploy a Web Application Firewall (WAF) rule to block requests to plugin admin endpoints that lack a valid _wpnonce parameter.
Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress session cookies to reduce cross-site request risk.

bash

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate wp-email-template
wp plugin delete wp-email-template