CVE-2025-60164: NewsmanApp CSRF Vulnerability

CVE-2025-60164 Overview

CVE-2025-60164 is a Cross-Site Request Forgery (CSRF) vulnerability in the NewsMAN NewsmanApp WordPress plugin. The flaw affects all versions up to and including 2.7.7. An attacker can chain the CSRF weakness with Stored Cross-Site Scripting (XSS) to inject persistent JavaScript into the affected WordPress site. Exploitation requires an authenticated administrator to visit a crafted page or click an attacker-controlled link. Successful attacks can lead to session hijacking, administrative account takeover, and persistent compromise of site visitors. The vulnerability is tracked under CWE-352.

Critical Impact
Attackers can plant persistent JavaScript payloads through forged administrator requests, enabling site-wide compromise and visitor-targeted attacks.

Affected Products

NewsMAN NewsmanApp WordPress plugin versions up to and including 2.7.7
WordPress sites with the newsmanapp plugin installed and activated
Administrators authenticated to vulnerable WordPress instances

Discovery Timeline

2025-09-26 - CVE-2025-60164 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-60164

Vulnerability Analysis

The vulnerability combines two weaknesses in the NewsmanApp plugin. First, sensitive state-changing endpoints lack proper CSRF protection, meaning the plugin does not verify a valid WordPress nonce on incoming requests. Second, input handled by those endpoints is stored and later rendered without sufficient output encoding, producing a Stored XSS condition. An attacker exploits this chain by hosting a malicious page that automatically submits a request to the target WordPress site. When an authenticated administrator visits the page, their browser sends the forged request along with valid session cookies. The plugin processes the request and stores the attacker-supplied script. Any subsequent visit that renders the stored content executes the injected JavaScript in the victim's browser session.

Root Cause

The root cause is missing or insufficient CSRF token validation on plugin endpoints that accept user-supplied input. The plugin trusts the authenticated session without verifying request origin through WordPress's wp_verify_nonce() mechanism. Compounding this, the affected handlers do not sanitize or escape input before persisting it, allowing script content to survive into rendered output. This combination maps directly to CWE-352: Cross-Site Request Forgery.

Attack Vector

The attack vector is network-based and requires user interaction from a privileged WordPress user. An attacker crafts an HTML page containing a hidden form or fetch() call targeting the vulnerable NewsmanApp endpoint. The attacker lures an authenticated administrator to the page through phishing or a comment containing the link. The browser submits the forged request with the administrator's authentication cookies. The plugin accepts the request, stores the malicious payload, and serves it to subsequent visitors. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to affect site visitors and other authenticated users. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-60164

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers in NewsmanApp-managed content such as newsletter templates or subscriber forms
WordPress administrator activity originating from external Referer headers pointing to untrusted domains
Outbound requests from site visitors to attacker-controlled domains following page loads that render NewsmanApp content
New or modified plugin records containing encoded payloads such as String.fromCharCode or base64-encoded scripts

Detection Strategies

Inspect database tables created by the NewsmanApp plugin for HTML or JavaScript content in fields expected to contain plain text
Review WordPress access logs for POST requests to NewsmanApp endpoints lacking the expected _wpnonce parameter
Deploy a Web Application Firewall rule to flag cross-origin requests targeting wp-admin/admin-ajax.php actions associated with the plugin

Monitoring Recommendations

Enable WordPress audit logging to capture all administrator actions and plugin configuration changes
Monitor browser Content Security Policy (CSP) violation reports for unexpected inline script execution on pages rendering plugin output
Alert on file integrity changes within the wp-content/plugins/newsmanapp/ directory and related database tables

How to Mitigate CVE-2025-60164

Immediate Actions Required

Deactivate the NewsmanApp plugin until a patched version is installed and verified
Audit all plugin-managed content for injected scripts and remove any unauthorized payloads
Force a password reset for all WordPress administrator accounts and invalidate active sessions
Review recent administrator activity logs for signs of CSRF-driven configuration changes

Patch Information

At the time of publication, the affected versions include all releases up to and including 2.7.7. Site operators should consult the Patchstack Vulnerability Report for vendor patch availability and upgrade to a fixed release as soon as one is published.

Workarounds

Restrict access to the WordPress administrative interface using IP allow-listing or VPN-only access
Deploy a Web Application Firewall rule that enforces same-origin checks on POST requests to plugin endpoints
Require administrators to use isolated browser profiles or sessions when managing the WordPress site
Implement a strict Content Security Policy that disallows inline script execution on pages rendering plugin output

bash

# Disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate newsmanapp

# Verify plugin status
wp plugin status newsmanapp