CVE-2025-60139: Sendle Shipping Plugin CSRF Vulnerability

CVE-2025-60139 Overview

CVE-2025-60139 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Joovii Sendle Shipping plugin for WordPress (official-sendle-shipping-method). The flaw exists in versions up to and including 6.02 and is tracked under [CWE-352]. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unintended state-changing actions in the plugin. Exploitation requires user interaction but no privileges or authentication on the attacker's side. The vulnerability was published to the National Vulnerability Database (NVD) on September 26, 2025.

Critical Impact
Successful exploitation allows attackers to perform unauthorized plugin actions on behalf of an authenticated WordPress user, potentially altering shipping configuration integrity.

Affected Products

Joovii Sendle Shipping WordPress plugin (official-sendle-shipping-method)
All versions from n/a through <= 6.02
WordPress sites using the Sendle Shipping integration for WooCommerce

Discovery Timeline

2025-09-26 - CVE CVE-2025-60139 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60139

Vulnerability Analysis

The Joovii Sendle Shipping plugin fails to implement adequate anti-CSRF protections on one or more state-changing request handlers. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer(), but the affected endpoints do not enforce or correctly validate these tokens. As a result, requests originating from an external site are processed with the authenticated user's session cookies. The impact is limited to integrity of plugin-managed data, with no direct confidentiality or availability consequences reported. The vulnerability requires the targeted user to click a crafted link or visit an attacker-controlled page while authenticated to WordPress.

Root Cause

The root cause is missing or improper CSRF token validation in plugin request handlers [CWE-352]. Without a per-session, per-form nonce validated on the server side, the plugin cannot distinguish between requests intentionally initiated by the user and forged requests submitted by third-party origins.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag that targets a vulnerable plugin endpoint. When a WordPress administrator or privileged user with an active session visits the page, the browser forwards their authentication cookies with the forged request. The plugin processes the request as if it were legitimate.

No verified exploit code is publicly available. See the Patchstack CSRF Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2025-60139

Indicators of Compromise

Unexpected modifications to Sendle Shipping plugin configuration entries in wp_options or plugin-specific database tables.
WordPress access logs showing POST requests to plugin admin endpoints with Referer headers pointing to external, unrelated domains.
Administrative actions recorded outside of normal working hours or from unusual client IP addresses.

Detection Strategies

Review WordPress audit logs for plugin setting changes that do not correlate with legitimate administrator activity.
Inspect HTTP request logs for state-changing requests missing the expected _wpnonce parameter.
Correlate browser-originated requests to plugin endpoints with suspicious cross-origin Referer or Origin header values.

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule to flag POST requests to /wp-admin/ plugin endpoints lacking valid nonce parameters.
Enable a WordPress security audit plugin to record configuration changes and administrator actions.
Alert on outbound HTTP referrals from external domains that trigger authenticated admin actions.

How to Mitigate CVE-2025-60139

Immediate Actions Required

Update the Joovii Sendle Shipping plugin to a version later than 6.02 as soon as a patched release is available from the vendor.
Restrict WordPress administrative access to trusted networks and enforce short session lifetimes.
Require administrators to log out of WordPress before browsing untrusted websites in the same browser profile.

Patch Information

Refer to the Patchstack CSRF Vulnerability Advisory for vendor patch status. If no fixed release is yet published, monitor the plugin repository for updates and apply them promptly.

Workarounds

Temporarily deactivate the official-sendle-shipping-method plugin if the shipping integration is not business-critical.
Configure a WAF rule to block requests to plugin endpoints when Origin or Referer headers do not match the site's own domain.
Enforce SameSite=Lax or SameSite=Strict cookie policies for WordPress authentication cookies to reduce CSRF exposure.

bash

# Example: block cross-origin POST requests to WordPress admin endpoints via nginx
map $http_origin $bad_origin {
    default 1;
    "~^https://your-wordpress-site\.example\.com$" 0;
}

server {
    location ~ ^/wp-admin/admin(-ajax|-post)?\.php$ {
        if ($request_method = POST) {
            if ($bad_origin) {
                return 403;
            }
        }
    }
}