CVE-2025-23793
Published: 16 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-23793 is a Cross-Site Request Forgery (CSRF) vulnerability in the Auto FTP WordPress plugin developed by Ciprian Turcu that enables Stored Cross-Site Scripting (XSS). The issue affects Auto FTP versions from an unspecified initial release through 1.0.1 and is associated with CWE-352.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited over the network with low attack complexity by unauthenticated attackers requiring user interaction. Exploitation involves tricking a user, such as an administrator, into performing a CSRF-triggered action that stores an XSS payload, allowing script execution in the context of authenticated users viewing affected pages and resulting in low-impact confidentiality, integrity, and availability violations.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/auto-ftp/vulnerability/wordpress-auto-ftp-plugin-1-0-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the CSRF-to-stored XSS vulnerability in the WordPress Auto FTP plugin version 1.0.1. Security practitioners should consult this reference for mitigation guidance, such as updating the plugin or implementing CSRF protections.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) to achieve script injection in authenticated user contexts.