CVE-2025-60170 Overview
CVE-2025-60170 is a Cross-Site Request Forgery (CSRF) vulnerability in the Taraprasad Swain HTACCESS IP Blocker WordPress plugin (htaccess-ip-blocker). The flaw chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious JavaScript in the plugin's configuration when an authenticated administrator visits an attacker-controlled page. The vulnerability affects all plugin versions through 1.0. The weakness is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
An attacker can hijack an authenticated administrator's session context to inject persistent JavaScript into the WordPress site, leading to account takeover, content manipulation, or further compromise of site visitors.
Affected Products
- Taraprasad Swain HTACCESS IP Blocker plugin for WordPress
- All versions from n/a through 1.0
- WordPress sites with the htaccess-ip-blocker plugin installed and active
Discovery Timeline
- 2025-09-26 - CVE-2025-60170 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-60170
Vulnerability Analysis
The HTACCESS IP Blocker plugin processes administrative form submissions without verifying request authenticity. The plugin's settings handlers do not validate WordPress nonces or check the request origin before writing data to the database. This omission allows an attacker to forge HTTP requests that the victim's browser submits with valid admin cookies.
The second-order impact is Stored XSS. Input received through the forged request is saved without proper sanitization or output encoding. When an administrator later loads the affected settings page, the malicious payload executes in the browser under the WordPress admin origin.
The attack requires user interaction (UI:R), specifically tricking an authenticated administrator into visiting a malicious or compromised page. The scope is changed (S:C) because the injected script executes beyond the vulnerable component, affecting any user rendering the stored content.
Root Cause
The root cause is the absence of two complementary defenses: anti-CSRF tokens on state-changing requests and input sanitization on stored configuration values. WordPress provides wp_nonce_field(), check_admin_referer(), and sanitization helpers such as sanitize_text_field() and esc_attr(), none of which are enforced on the vulnerable code paths in version 1.0.
Attack Vector
The attacker hosts a page containing a hidden form or fetch() call targeting the plugin's settings endpoint. The form payload contains JavaScript inside a configuration field. When an authenticated WordPress administrator visits the attacker's page, the browser sends the request with valid session cookies. The plugin accepts the request, stores the payload, and later renders it unescaped in the admin UI, triggering execution.
No verified public exploit code is available. See the PatchStack Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2025-60170
Indicators of Compromise
- Unexpected <script>, onerror=, or javascript: strings stored within HTACCESS IP Blocker plugin options in the wp_options table.
- Administrator browser sessions making outbound requests to unfamiliar domains shortly after loading the WordPress admin dashboard.
- Unauthorized modifications to .htaccess rules or IP block lists managed by the plugin.
- New WordPress administrator accounts created without a corresponding audit trail.
Detection Strategies
- Inspect wp_options rows associated with the htaccess-ip-blocker plugin for HTML or JavaScript content that should not appear in IP-blocking configuration.
- Review web server access logs for POST requests to the plugin's admin endpoints originating from external Referer headers.
- Monitor WordPress audit logs for plugin settings changes that lack a corresponding admin session interaction.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record settings changes, login events, and user creation in real time.
- Forward web server and WordPress logs to a centralized log platform and alert on anomalous admin-area POST activity.
- Apply Content Security Policy (CSP) headers to the WordPress admin area to constrain inline script execution and surface violations.
How to Mitigate CVE-2025-60170
Immediate Actions Required
- Deactivate and remove the HTACCESS IP Blocker plugin until a patched version is released by the maintainer.
- Audit the wp_options table and remove any malicious payloads stored by the plugin.
- Force a password reset for all WordPress administrator accounts and invalidate active sessions.
- Review .htaccess files for unauthorized rules that may have been introduced through the plugin.
Patch Information
No vendor patch is referenced in the advisory. The vulnerability affects all versions through 1.0. Monitor the PatchStack advisory and the plugin's WordPress.org page for fix availability.
Workarounds
- Replace the plugin with an actively maintained alternative that enforces nonce validation and input sanitization.
- Restrict access to /wp-admin/ by source IP using web server configuration or a Web Application Firewall (WAF).
- Require administrators to use a dedicated browser profile when accessing WordPress to limit cross-site cookie exposure.
- Deploy a WAF rule that blocks unauthenticated cross-origin POST requests to WordPress admin endpoints.
# Example: restrict WordPress admin access by IP in Apache .htaccess
<Files "admin-ajax.php">
Require all denied
Require ip 203.0.113.0/24
</Files>
<Directory "/var/www/html/wp-admin">
Require ip 203.0.113.0/24
</Directory>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
