CVE-2025-60111: Javo Core CSRF Auth Bypass Vulnerability

CVE-2025-60111 Overview

CVE-2025-60111 is a Cross-Site Request Forgery (CSRF) vulnerability in the javothemes Javo Core WordPress plugin. The flaw affects all versions up to and including 3.0.0.266 and enables authentication bypass when a victim is tricked into visiting an attacker-controlled page. The weakness is classified as [CWE-352] and stems from missing or insufficient anti-CSRF token validation in privileged plugin actions.

Critical Impact

Attackers can forge authenticated requests against vulnerable WordPress sites running Javo Core, leading to authentication bypass with high impact to confidentiality, integrity, and availability when an authenticated user visits a malicious page.

Affected Products

• javothemes Javo Core (javo-core) plugin for WordPress
• All versions from initial release through 3.0.0.266
• WordPress sites embedding the Javo Core component in Javo themes

Discovery Timeline

• 2025-09-26 - CVE-2025-60111 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-60111

Vulnerability Analysis

The vulnerability resides in privileged request handlers within the Javo Core plugin that fail to validate WordPress nonces or equivalent anti-CSRF tokens. Without server-side request origin verification, the plugin accepts state-changing requests purely based on the victim's authenticated session cookie. An attacker who lures an authenticated administrator or privileged user to a crafted web page can trigger plugin actions on the user's behalf. The Patchstack advisory notes the issue chains into authentication bypass, meaning the forged request can manipulate authentication-related state rather than only standard configuration changes.

Root Cause

The root cause is missing or improperly implemented CSRF protection on sensitive endpoints exposed by javo-core. WordPress provides wp_nonce_field() and check_admin_referer() / wp_verify_nonce() primitives for protecting administrative actions. The affected handlers either omit these checks or apply them inconsistently, allowing requests originating from third-party domains to be processed as legitimate.

Attack Vector

Exploitation requires user interaction (UI:R). An attacker hosts a malicious page containing an auto-submitting HTML form or fetch() call targeting the vulnerable plugin endpoint. When an authenticated WordPress user with sufficient privileges visits the page, the browser attaches session cookies and submits the request. The plugin processes it without verifying intent, achieving authentication bypass and privileged state changes. No credentials or prior access to the target site are required by the attacker.

Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-60111

Indicators of Compromise

• Unexpected creation, modification, or privilege changes on WordPress user accounts shortly after an administrator browsing session.
• Access log entries showing POST requests to javo-core endpoints with Referer headers pointing to external, untrusted domains.
• Modifications to plugin or theme settings that do not correlate with legitimate administrator activity in wp-admin audit trails.

Detection Strategies

• Inspect WordPress access logs for requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php carrying Javo Core action parameters with cross-origin referers.
• Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to plugin endpoints lacking a valid _wpnonce parameter.
• Monitor WordPress audit logs for option, user, or role changes attributed to Javo Core actions outside maintenance windows.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture user role changes, plugin setting updates, and login anomalies.
• Forward webserver and WordPress logs to a centralized SIEM and alert on referer/origin mismatches against administrative endpoints.
• Track outbound clicks and email links delivered to administrator accounts that could serve as CSRF lures.

How to Mitigate CVE-2025-60111

Immediate Actions Required

• Identify all WordPress installations running the Javo Core plugin and confirm whether the version is 3.0.0.266 or earlier.
• Restrict WordPress administrative access to trusted networks or VPN ranges until a patched version is deployed.
• Require administrators to use isolated browser profiles when managing WordPress to reduce CSRF lure exposure.

Patch Information

At the time of NVD publication, the advisory lists affected versions through <= 3.0.0.266 with no fixed version explicitly enumerated. Site operators should consult the Patchstack WordPress Vulnerability Report and the javothemes vendor channels for an updated release that adds nonce validation, then update immediately upon availability.

Workarounds

• Deactivate the Javo Core plugin until a patched version is released if the affected functionality is non-essential.
• Apply a virtual patch via WAF to block requests to Javo Core action handlers that lack a valid _wpnonce token or carry an external Origin/Referer header.
• Enforce SameSite=Lax or SameSite=Strict cookie attributes on the WordPress authentication cookie to limit cross-site cookie attachment.
• Train administrators to log out of WordPress sessions before browsing untrusted sites and to use dedicated admin browsers.

# Example WAF rule logic to block Javo Core requests with cross-origin referer
# (adapt syntax to your WAF; ModSecurity-style pseudo-rule)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1060111,msg:'Block CSRF on javo-core'"
  SecRule ARGS:action "@beginsWith javo_" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/" "t:lowercase"