CVE-2025-6059 Overview
CVE-2025-6059 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Seraphinite Accelerator plugin for WordPress in all versions up to and including 2.27.21. The flaw resides in the OnAdminApi_CacheOpBegin function, which lacks proper nonce validation. Unauthenticated attackers can trigger administrative actions, including cache deletion, by tricking a site administrator into clicking a crafted link. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed.
Critical Impact
Attackers can force authenticated WordPress administrators to execute unauthorized cache management actions on the Seraphinite Accelerator plugin without their consent.
Affected Products
- Seraphinite Accelerator plugin for WordPress
- All versions up to and including 2.27.21
- WordPress sites where an administrator can be socially engineered into clicking a link
Discovery Timeline
- 2025-06-14 - CVE-2025-6059 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6059
Vulnerability Analysis
The Seraphinite Accelerator plugin exposes an administrative API endpoint handled by the OnAdminApi_CacheOpBegin function. This handler performs privileged actions such as cache invalidation but does not verify a WordPress nonce token before executing the requested operation. Because state-changing operations are not tied to a unique per-session token, the server accepts requests originating from any external context that carries the administrator's authentication cookies.
An attacker who convinces a logged-in administrator to visit an attacker-controlled page can issue forged requests from the browser. The plugin processes these requests as legitimate administrative actions. Impact is limited to integrity: cache state can be altered, which may degrade site performance or cause stale content to be served. Confidentiality and availability are not directly affected according to the reported CVSS vector.
Root Cause
The root cause is missing or incorrect nonce validation in the OnAdminApi_CacheOpBegin handler in main.php. WordPress provides check_admin_referer() and wp_verify_nonce() primitives to prevent CSRF, but the vulnerable code path either omits the check or performs it incorrectly. See the WordPress Plugin Source Code and the WordPress Plugin Changeset for the corrective patch.
Attack Vector
Exploitation requires an unauthenticated attacker to host a malicious page containing an auto-submitting form or image tag targeting the vulnerable admin endpoint. When a WordPress administrator authenticated to the target site loads the attacker's page, the browser attaches session cookies to the forged request. The plugin then executes the cache operation with the administrator's privileges. The Wordfence Vulnerability Analysis provides additional technical context.
Detection Methods for CVE-2025-6059
Indicators of Compromise
- Unexpected cache purge events in WordPress activity logs without a corresponding administrator UI session
- HTTP requests to admin-ajax.php or plugin admin endpoints with Referer headers pointing to external domains
- Administrator sessions generating cache operation requests immediately after visiting untrusted URLs
Detection Strategies
- Monitor web server access logs for POST requests targeting the Seraphinite Accelerator admin API without a valid _wpnonce parameter
- Correlate administrator browser activity with plugin state changes to identify requests lacking a legitimate origin
- Deploy a Web Application Firewall (WAF) rule to flag cross-origin requests to WordPress admin endpoints
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all cache operations and the responsible user
- Alert on administrator accounts triggering cache modifications outside of scheduled maintenance windows
- Review referrer patterns on plugin administrative endpoints for anomalous external sources
How to Mitigate CVE-2025-6059
Immediate Actions Required
- Update the Seraphinite Accelerator plugin to the version released in changeset 3284098, which is later than 2.27.21
- Instruct administrators to log out of WordPress sessions before browsing untrusted sites
- Restrict administrative access to trusted networks using IP allowlisting where feasible
Patch Information
The plugin maintainer addressed the missing nonce validation in the changeset published to the WordPress plugin repository. Site owners should upgrade to the version immediately following 2.27.21. Review the WordPress Plugin Changeset to confirm the patch adds proper nonce verification to the OnAdminApi_CacheOpBegin handler.
Workarounds
- Deactivate the Seraphinite Accelerator plugin until the patched version is installed
- Configure the WordPress site to enforce SameSite=Strict cookies to reduce cross-site request risk
- Deploy a WAF rule that requires a valid Referer and Origin header matching the site domain for all wp-admin requests
# Update the plugin via WP-CLI
wp plugin update seraphinite-accelerator
# Verify installed version is above 2.27.21
wp plugin get seraphinite-accelerator --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
