CVE-2025-60113: Groovy Menu CSRF Vulnerability

CVE-2025-60113 Overview

CVE-2025-60113 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the grooni Groovy Menu (groovy-menu-free) plugin for WordPress. The flaw impacts all versions up to and including 1.4.3. The vulnerability is tracked under [CWE-352] and requires user interaction to trigger, typically by luring an authenticated administrator to a malicious page.

Successful exploitation allows an attacker to force a logged-in user's browser to submit forged state-changing requests to the WordPress site. This can result in unauthorized modification of plugin settings without the victim's consent.

Critical Impact
An attacker who convinces an authenticated WordPress user to visit a crafted page can execute privileged actions in the Groovy Menu plugin under the victim's session, leading to integrity impact on plugin configuration.

Affected Products

grooni Groovy Menu (groovy-menu-free) plugin for WordPress
All versions from n/a through <= 1.4.3
WordPress installations with the affected plugin enabled

Discovery Timeline

2025-09-26 - CVE CVE-2025-60113 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60113

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protections on state-changing endpoints exposed by the Groovy Menu plugin. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) that plugins must use to validate the authenticity of requests originating from authorized users. The affected plugin does not properly validate these nonces on one or more sensitive actions.

Because the request forgery relies on the victim's existing authentication cookies, the server cannot distinguish between a legitimate administrator action and a forged request initiated from an attacker-controlled origin. Exploitation requires user interaction, so the attacker must social-engineer an authenticated user into visiting a malicious URL or page containing the forged request. The impact is limited to integrity, with no direct confidentiality or availability consequences.

Root Cause

The root cause is a missing or improperly implemented anti-CSRF token check on privileged plugin endpoints, mapped to [CWE-352] Cross-Site Request Forgery. Requests are processed based solely on session cookies without verifying a request-bound token.

Attack Vector

The attack vector is network-based and user-interaction dependent. An attacker hosts a page containing an auto-submitting HTML form or image tag that issues a request to a vulnerable plugin endpoint on the target WordPress site. When an authenticated administrator visits the attacker's page, the browser attaches session cookies, and the plugin executes the forged action. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-60113

Indicators of Compromise

Unexpected changes to Groovy Menu plugin configuration or menu structure without a corresponding administrator action in audit logs.
HTTP POST requests to Groovy Menu admin endpoints with a Referer header pointing to an external, untrusted domain.
Administrator sessions generating plugin configuration changes immediately after visiting an external link.

Detection Strategies

Review WordPress access logs for state-changing requests to wp-admin endpoints associated with groovy-menu-free that lack a valid _wpnonce parameter.
Correlate administrator browsing activity with plugin configuration change events to identify anomalous request origins.
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to WordPress admin URLs.

Monitoring Recommendations

Enable WordPress audit logging to track plugin setting modifications and user actions.
Monitor for Referer and Origin header mismatches on privileged WordPress endpoints.
Track EPSS scoring over time; the current EPSS probability is 0.131% at percentile 3.074, indicating low observed exploitation likelihood.

How to Mitigate CVE-2025-60113

Immediate Actions Required

Identify all WordPress sites running the groovy-menu-free plugin at version 1.4.3 or earlier.
Deactivate the plugin until a patched version is installed if no fix is available.
Force reauthentication for all administrator accounts to invalidate any potentially forged session context.

Patch Information

No fixed version has been published in the enriched CVE data at the time of this writing. Consult the Patchstack WordPress Vulnerability Report and the plugin vendor's page for updates. Upgrade to a version later than 1.4.3 once released by grooni.

Workarounds

Restrict access to the WordPress admin interface by IP allowlisting via web server or reverse proxy configuration.
Require administrators to use browser profiles that do not share cookies with general browsing sessions.
Deploy a WAF rule that blocks requests to WordPress admin endpoints when the Origin or Referer header does not match the site's own domain.
Educate administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard.

bash

# Example nginx configuration to enforce same-origin on WordPress admin
location ~ ^/wp-admin/ {
    if ($http_referer !~* ^https?://your-site\.example/) {
        return 403;
    }
}