WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability

The CSRF vulnerability in Create Posts & Terms allows an attacker to trick a legitimate user into performing unintended actions on the WordPress site. Because this vulnerability leads to Stored XSS, the attacker can inject malicious scripts that are stored on the server and executed when other users visit affected pages. This could result in session hijacking, defacement of the website, redirection to malicious sites, or the theft of sensitive user data. The blast radius extends to all users who interact with the plugin, particularly those with administrative privileges.

Websites using the Create Posts & Terms plugin, particularly those with user roles that have the ability to create or modify posts and terms, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'create_posts_terms' /var/www/html/wp-content/plugins/
wp plugin list | grep create_posts_terms

• generic web:

curl -I https://example.com/wp-content/plugins/create-posts-terms/ | grep -i 'create-posts-terms'

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-06-04
2. Veröffentlicht2025-12-09
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-49351 is to upgrade to a patched version of the Create Posts & Terms plugin as soon as it becomes available. Until then, consider implementing temporary workarounds. Input validation on all user-supplied data within the plugin is crucial to prevent XSS. Implementing CSRF tokens on all sensitive actions within the plugin will significantly reduce the risk of unauthorized requests. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can also provide an additional layer of protection.

Aktive Installationen

70

Plugin-Bewertung