CVE-2025-60172: Flytedesk Digital CSRF Vulnerability

CVE-2025-60172 Overview

CVE-2025-60172 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Flytedesk Digital WordPress plugin. This security flaw allows attackers to perform CSRF attacks that can lead to Stored Cross-Site Scripting (XSS) on affected WordPress installations. The vulnerability affects all versions of the Flytedesk Digital plugin through version 20181101.

Critical Impact

Attackers can exploit this CSRF vulnerability to inject malicious scripts that persist on the target website, potentially compromising administrative accounts and site visitors.

Affected Products

• Flytedesk Digital WordPress Plugin versions through 20181101
• WordPress installations running vulnerable Flytedesk Digital plugin versions

Discovery Timeline

• 2025-09-26 - CVE-2025-60172 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-60172

Vulnerability Analysis

This vulnerability combines two distinct attack vectors: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The CSRF component enables attackers to trick authenticated administrators into unknowingly submitting malicious requests to the vulnerable plugin. When successful, these requests inject malicious JavaScript payloads that are stored persistently within the WordPress installation.

The chained nature of this vulnerability significantly increases its potential impact. While CSRF alone requires social engineering to exploit, the combination with Stored XSS means that a single successful attack can affect all subsequent visitors to the compromised pages. This includes administrative users whose sessions could be hijacked for further malicious activities.

Root Cause

The root cause of CVE-2025-60172 stems from the absence of proper CSRF token validation (CWE-352) in the Flytedesk Digital plugin's form handling mechanisms. The plugin fails to implement nonce verification for state-changing operations, allowing attackers to craft malicious requests that will be processed as legitimate administrative actions. Additionally, insufficient input sanitization and output encoding enables the injected content to be stored and executed as JavaScript in users' browsers.

Attack Vector

The attack vector for this vulnerability involves crafting a malicious HTML page or link that, when visited by an authenticated WordPress administrator, automatically submits a forged request to the vulnerable Flytedesk Digital plugin. This request contains malicious JavaScript code that gets stored in the WordPress database.

The exploitation flow typically follows this pattern: An attacker creates a webpage containing a hidden form that targets the vulnerable plugin endpoint. When an authenticated administrator visits this page, their browser automatically submits the form using their existing session credentials. The malicious payload is then stored and executes whenever the affected page is loaded by any user.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60172

Indicators of Compromise

• Unexpected or suspicious JavaScript code injected into WordPress pages or posts
• Plugin settings modified without administrator knowledge or approval
• Unusual HTTP POST requests to Flytedesk Digital plugin endpoints in access logs
• Reports of browser security warnings or unexpected redirects from site visitors

Detection Strategies

• Review WordPress access logs for POST requests to /wp-admin/ endpoints associated with the Flytedesk Digital plugin from external referrer URLs
• Implement Web Application Firewall (WAF) rules to detect and block requests containing suspicious script tags or JavaScript event handlers
• Audit plugin settings and database entries for unauthorized modifications or injected content
• Deploy file integrity monitoring to detect unauthorized changes to plugin files

Monitoring Recommendations

• Enable comprehensive logging for all WordPress administrative actions and plugin-related API calls
• Configure real-time alerts for any modifications to Flytedesk Digital plugin settings
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS payloads
• Monitor for unusual patterns of cross-origin requests targeting your WordPress installation

How to Mitigate CVE-2025-60172

Immediate Actions Required

• Immediately deactivate and remove the Flytedesk Digital plugin from all WordPress installations
• Audit existing WordPress content for any injected malicious scripts or unauthorized modifications
• Review WordPress access logs to identify potential exploitation attempts
• Reset administrative credentials if there is any indication of compromise

Patch Information

At the time of publication, no official patch has been released for this vulnerability. The affected plugin version 20181101 is the latest known version. Organizations using this plugin should consider removing it entirely and seeking alternative solutions until a security update is made available.

For the latest information on patches and updates, consult the Patchstack Vulnerability Report.

Workarounds

• Deactivate and remove the Flytedesk Digital plugin until a patched version becomes available
• Implement Web Application Firewall (WAF) rules to filter malicious CSRF and XSS payloads
• Restrict administrative access to trusted IP addresses only to reduce the attack surface
• Enable two-factor authentication for all WordPress administrator accounts

# WordPress CLI commands to disable and remove the vulnerable plugin
wp plugin deactivate flytedesk-digital
wp plugin delete flytedesk-digital

# Verify plugin removal
wp plugin list --status=active | grep flytedesk