CVE-2025-60115 Overview
CVE-2025-60115 is a Cross-Site Request Forgery (CSRF) vulnerability in the instapage WordPress plugin developed by instapagedev. The flaw affects all plugin versions up to and including 3.7.0. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unintended state-changing actions in the plugin without the user's consent. The weakness is classified under [CWE-352]. Exploitation requires user interaction, such as clicking a crafted link while logged into the WordPress site hosting the vulnerable plugin.
Critical Impact
An authenticated WordPress user can be tricked into performing unauthorized actions in the Instapage plugin, resulting in limited integrity impact on plugin configuration or data.
Affected Products
- Instapage Plugin for WordPress, versions up to and including 3.7.0
- Vendor: instapagedev
- Component: instapage WordPress plugin
Discovery Timeline
- 2025-09-26 - CVE-2025-60115 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60115
Vulnerability Analysis
The Instapage WordPress plugin fails to validate the origin of state-changing HTTP requests. The plugin does not enforce anti-CSRF tokens (WordPress nonces) or does not verify them correctly on sensitive endpoints. Because WordPress relies on session cookies for authentication, browsers automatically attach those cookies to any request directed at the site, including requests initiated from third-party origins. An attacker exploits this behavior by hosting a page that submits a forged request to the vulnerable plugin endpoint while the victim is authenticated.
Successful exploitation grants the attacker the ability to alter plugin state within the victim's privilege boundary. The impact is limited to integrity, with no direct confidentiality or availability consequences reported. Exploitation requires the victim to visit attacker-controlled content, which lowers the reliability of the attack but does not prevent it.
Root Cause
The root cause is the absence or incorrect implementation of CSRF protections on plugin request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose. Versions up to 3.7.0 of the instapage plugin do not consistently enforce these controls on state-changing endpoints.
Attack Vector
The attack is delivered over the network and requires user interaction. An attacker sends a crafted link, email, or hosts a malicious page containing an auto-submitting HTML form or JavaScript that issues a request to the target WordPress site. When a logged-in administrator or authorized user loads the page, the browser transmits the forged request with valid session cookies, and the plugin processes it as legitimate. No credentials are required from the attacker directly. Technical details are documented in the Patchstack Vulnerability Report.
Detection Methods for CVE-2025-60115
Indicators of Compromise
- Unexpected changes to Instapage plugin configuration or page mappings in WordPress
- HTTP POST requests to Instapage plugin admin endpoints with Referer headers pointing to external, untrusted domains
- WordPress audit log entries showing plugin setting changes without a corresponding administrator session in the site's activity history
Detection Strategies
- Inspect web server access logs for requests to /wp-admin/admin.php or admin-ajax.php targeting Instapage actions with cross-origin Referer or missing nonce parameters
- Deploy a WordPress activity logging plugin to record all plugin setting modifications and correlate them with authenticated sessions
- Use a web application firewall (WAF) rule to flag state-changing requests to the plugin that lack a valid _wpnonce token
Monitoring Recommendations
- Alert on Instapage plugin configuration changes outside of scheduled administrative windows
- Monitor the WordPress wp_options table and plugin-specific tables for unexpected writes
- Track authenticated administrator browser sessions and flag requests originating from external referrers to admin endpoints
How to Mitigate CVE-2025-60115
Immediate Actions Required
- Update the Instapage plugin to a version later than 3.7.0 as soon as a patched release is available from instapagedev
- Restrict WordPress administrator accounts to dedicated browsers or sessions that are not used for general browsing
- Enforce strong session policies and require administrators to log out when not actively managing the site
Patch Information
At the time of publication, the vulnerability affects Instapage Plugin versions up to and including 3.7.0. Consult the Patchstack Vulnerability Report and the plugin vendor's changelog for the fixed release. Apply the update through the WordPress plugin management interface once available.
Workarounds
- Temporarily deactivate the Instapage plugin until a patched version is installed
- Deploy a WAF rule that blocks POST requests to Instapage endpoints when the Origin or Referer header does not match the site's own domain
- Limit access to the WordPress admin interface by IP allowlisting through the web server or reverse proxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
