CVE-2025-58865: Compact Admin CSRF Vulnerability

CVE-2025-58865 Overview

CVE-2025-58865 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the reimund Compact Admin WordPress plugin (compact-admin) through version 1.3.3. The flaw allows attackers to trick authenticated administrators into submitting unintended state-changing requests to a target WordPress site. Exploitation requires user interaction, typically by luring a logged-in administrator to a malicious page or link. Successful exploitation impacts data integrity within the plugin's administrative functions. The vulnerability was published to the National Vulnerability Database (NVD) on September 5, 2025.

Critical Impact
An unauthenticated attacker can perform limited unauthorized state-changing actions in the WordPress administrative interface if a logged-in admin visits an attacker-controlled page.

Affected Products

reimund Compact Admin WordPress plugin — versions up to and including 1.3.3
WordPress sites with the compact-admin plugin installed and activated
Administrator accounts with active authenticated sessions to the affected plugin

Discovery Timeline

2025-09-05 - CVE-2025-58865 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58865

Vulnerability Analysis

The compact-admin plugin fails to validate the origin and intent of state-changing HTTP requests submitted to its administrative endpoints. WordPress plugins are expected to use nonce tokens generated via wp_nonce_field() and verified with check_admin_referer() or wp_verify_nonce() to defend against forged requests. In the vulnerable plugin, these anti-CSRF checks are either missing or improperly implemented on privileged actions. An attacker who can lure an authenticated administrator to click a crafted link or load a malicious page can cause the browser to submit an authenticated request to the target site. Because impact is limited to integrity with no confidentiality or availability effect, the vulnerability is scoped to unauthorized modifications within the plugin's administrative functionality rather than full site takeover.

Root Cause

The root cause is the absence of proper CSRF token validation [CWE-352] on request handlers that perform administrative changes. Without a per-session or per-request nonce, the plugin cannot distinguish requests initiated by an administrator using the WordPress dashboard from requests forged by a third-party site abusing the browser's automatic cookie transmission.

Attack Vector

The attack is delivered over the network and requires user interaction. The attacker crafts a malicious HTML page containing a form or resource that submits a request to the target WordPress site's compact-admin endpoint. When an authenticated administrator visits the page, the browser transmits the request along with valid session cookies, and the plugin processes the action without verifying its origin. The vulnerability manifests when privileged plugin actions lack nonce checks. See the Patchstack WordPress Vulnerability Advisory for technical specifics.

Detection Methods for CVE-2025-58865

Indicators of Compromise

Unexpected configuration changes within the compact-admin plugin settings that do not correlate with legitimate administrator activity.
Web server access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
Administrator sessions performing plugin actions immediately after visiting external URLs in browser history.

Detection Strategies

Review WordPress audit logs for plugin setting changes correlated with cross-origin referrers or unusual timing.
Inspect HTTP request logs for administrative plugin actions that lack a valid _wpnonce parameter.
Deploy web application firewall rules that flag state-changing requests to wp-admin endpoints missing nonce parameters.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture administrator actions with source IP and referrer metadata.
Alert on plugin configuration changes performed outside standard maintenance windows.
Monitor administrator browsing patterns and correlate with plugin state changes to identify social engineering attempts.

How to Mitigate CVE-2025-58865

Immediate Actions Required

Deactivate the compact-admin plugin until a patched release is available and verified.
Instruct administrators to log out of WordPress sessions before browsing untrusted sites.
Enforce use of separate browsers or browser profiles for WordPress administrative work.
Review recent plugin configuration changes and revert any unauthorized modifications.

Patch Information

As of the latest NVD update, versions of compact-admin up to and including 1.3.3 are affected. Administrators should monitor the Patchstack advisory and the WordPress plugin repository for a fixed release. Apply the patch immediately once published and verify the plugin version after upgrade.

Workarounds

Uninstall the compact-admin plugin if it is not business critical.
Restrict access to /wp-admin/ by source IP address using web server or firewall rules.
Deploy a web application firewall rule that requires a valid _wpnonce parameter on state-changing plugin requests.
Configure the SameSite=Lax or SameSite=Strict attribute on WordPress session cookies to reduce cross-site request risk.

bash

# Example nginx rule blocking cross-origin POST requests to wp-admin
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $block_csrf 0;
        if ($http_referer !~* "^https?://your-site\.example/") {
            set $block_csrf 1;
        }
        if ($block_csrf = 1) {
            return 403;
        }
    }
}