CVE-2025-60137: Post Featured Video CSRF Vulnerability

CVE-2025-60137 Overview

CVE-2025-60137 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Galaxy Weblinks Post Featured Video plugin for WordPress. The flaw exists in all versions up to and including 1.7. An unauthenticated attacker can trick an authenticated user into submitting a forged request to the vulnerable plugin. Successful exploitation requires user interaction, such as clicking a crafted link while logged in. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can perform limited integrity-impacting actions on behalf of an authenticated WordPress user by exploiting missing CSRF protections in the Post Featured Video plugin.

Affected Products

Galaxy Weblinks Post Featured Video plugin for WordPress
All versions from n/a through 1.7
WordPress sites with the post-featured-video plugin installed and active

Discovery Timeline

2025-09-26 - CVE-2025-60137 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60137

Vulnerability Analysis

The Post Featured Video plugin fails to validate the origin of state-changing HTTP requests. WordPress plugins should implement nonce verification using wp_verify_nonce() or check_admin_referer() on any endpoint that modifies data. This plugin omits or improperly implements those checks through version 1.7.

An attacker hosts a malicious page containing a hidden form or JavaScript that submits a request to the target WordPress site. If a privileged user visits the attacker-controlled page while authenticated to WordPress, the browser transmits the user's session cookies with the forged request. The plugin then processes the request as legitimate.

The scope is limited to integrity impact. The vulnerability does not directly expose confidential data or degrade availability, but it can modify plugin state or configuration accessible to the victim's role.

Root Cause

The root cause is missing CSRF token validation on plugin endpoints that accept state-changing requests. The plugin does not enforce wp_nonce_field() generation on forms or verify tokens on incoming POST requests, allowing cross-origin requests to succeed.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a malicious HTML page or link and delivers it via phishing, forum posts, or malicious advertisements. When an authenticated WordPress administrator or contributor loads the payload, their browser submits the forged request to the target site, executing plugin actions under the victim's privileges.

No authentication is required by the attacker. The vulnerability leverages the victim's authenticated session against them.

Detection Methods for CVE-2025-60137

Indicators of Compromise

Unexpected changes to featured video settings or post metadata associated with the post-featured-video plugin
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains
Administrative actions in wp-admin originating from unusual IP addresses or user agents shortly after a user visited an external link

Detection Strategies

Audit installed WordPress plugins and flag any instance of Post Featured Video at version 1.7 or earlier
Review web server logs for POST requests to plugin routes lacking a valid _wpnonce parameter
Correlate WordPress user_meta and post revision history against known administrative activity windows

Monitoring Recommendations

Enable WordPress audit logging plugins to capture all plugin configuration changes with user attribution
Monitor outbound referrers on administrative sessions and alert on cross-origin POST submissions to wp-admin or admin-ajax.php
Track plugin version inventory across managed WordPress sites to identify unpatched deployments

How to Mitigate CVE-2025-60137

Immediate Actions Required

Identify all WordPress installations running the Post Featured Video plugin at version 1.7 or earlier
Deactivate and remove the plugin if a patched version is not yet available from the vendor
Instruct administrators to log out of WordPress before browsing untrusted external sites

Patch Information

At the time of publication, the Patchstack Vulnerability Report indicates the vulnerability affects all versions up to and including 1.7. Site operators should monitor the plugin's repository for an updated release that adds nonce verification and upgrade immediately when available.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block POST requests to post-featured-video endpoints that lack a valid WordPress nonce
Restrict access to wp-admin by IP allowlisting where operationally feasible
Enforce the SameSite=Lax or SameSite=Strict attribute on WordPress authentication cookies to reduce cross-origin request risk

bash

# Example nginx rule to require Referer header matching site origin for plugin endpoints
location ~ /wp-content/plugins/post-featured-video/ {
    valid_referers server_names;
    if ($invalid_referer) {
        return 403;
    }
}