CVE-2025-60145 Overview
CVE-2025-60145 is a Cross-Site Request Forgery (CSRF) vulnerability in the lenix-scss-compiler WordPress plugin by yonifre. The flaw affects all versions up to and including 1.2. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unintended state-changing actions in the plugin. The issue is tracked under CWE-352 and requires user interaction to succeed. Per Patchstack analysis, exploitation results in limited integrity impact without confidentiality or availability effects.
Critical Impact
Successful exploitation allows an attacker to perform authenticated actions in the Lenix scss compiler plugin on behalf of a logged-in user, altering plugin state without consent.
Affected Products
- yonifre Lenix scss compiler (lenix-scss-compiler) plugin for WordPress
- All versions up to and including 1.2
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-09-26 - CVE-2025-60145 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60145
Vulnerability Analysis
The vulnerability stems from missing anti-CSRF protections in one or more state-changing request handlers exposed by the Lenix scss compiler plugin. Request handlers do not validate a WordPress nonce or equivalent origin-bound token before processing sensitive actions. As a result, a forged HTTP request submitted from an attacker-controlled origin is accepted as legitimate when the victim's browser automatically attaches session cookies.
The attack requires user interaction, typically clicking a link or visiting a page under the attacker's control. Impact is confined to integrity, as the attacker can trigger administrative actions but cannot directly read protected data or disable the site.
Root Cause
The root cause is the absence of CSRF countermeasures in privileged endpoints. WordPress plugins are expected to call wp_verify_nonce() or check_admin_referer() on state-changing requests and to validate the request origin. In lenix-scss-compiler versions through 1.2, these checks are missing or insufficient, permitting cross-origin form submissions to succeed under an authenticated session.
Attack Vector
The attack vector is network-based and requires the victim, typically a WordPress administrator, to visit a malicious page while authenticated to the target site. The malicious page issues a forged POST or GET request to a vulnerable plugin endpoint. Because the browser sends the administrator's authentication cookies with the request, the plugin processes the action as legitimate. Refer to the Patchstack Vulnerability Analysis for further technical detail.
Detection Methods for CVE-2025-60145
Indicators of Compromise
- Unexpected changes to Lenix scss compiler plugin settings or compiled SCSS output on the WordPress site.
- HTTP requests to plugin endpoints containing an external Referer or Origin header inconsistent with the site domain.
- Administrator sessions performing plugin actions shortly after visiting external links or emails.
Detection Strategies
- Review WordPress access logs for POST requests to lenix-scss-compiler handler paths that lack a valid _wpnonce parameter.
- Correlate administrator browsing activity with plugin configuration changes recorded in audit logs.
- Deploy a web application firewall (WAF) rule to flag cross-origin submissions targeting the plugin's admin AJAX endpoints.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes and administrator actions.
- Monitor Referer and Origin header anomalies on all /wp-admin/ and admin-ajax.php traffic.
- Alert on plugin configuration modifications occurring outside scheduled maintenance windows.
How to Mitigate CVE-2025-60145
Immediate Actions Required
- Deactivate the Lenix scss compiler plugin until a patched version is confirmed available from the vendor.
- Restrict WordPress administrator access using strong authentication and session controls.
- Instruct administrators to log out of WordPress before browsing untrusted sites or clicking unverified links.
Patch Information
At the time of publication, no fixed version beyond 1.2 is listed in the referenced advisory. Site owners should monitor the Patchstack Vulnerability Analysis for updates and apply any vendor-supplied patch as soon as it becomes available.
Workarounds
- Remove the lenix-scss-compiler plugin from production WordPress installations if a patch is not yet available.
- Deploy WAF rules that enforce SameSite cookie behavior and block cross-origin state-changing requests to plugin endpoints.
- Require administrators to use dedicated browser profiles or sessions for WordPress administration, isolating them from general browsing.
- Enforce two-step confirmation for sensitive plugin actions via custom middleware where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
