WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

The CSRF vulnerability in OpenHook allows an attacker to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify plugin settings, create or delete content, or perform other actions as if they were the authenticated user. The potential impact depends on the permissions granted to the affected user account. This could lead to data modification, unauthorized access, or even complete control over the WordPress site if the user has administrative privileges. The attack surface is broad, as any user of the plugin is potentially vulnerable.

Websites using the OpenHook WordPress plugin, particularly those with users who have administrative or editor roles, are at risk. Shared hosting environments where plugin updates are managed by the hosting provider may also be vulnerable if updates are not applied promptly.

• wordpress / composer / npm:

grep -r 'openhook_save_options' /var/www/html/wp-content/plugins/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=openhook_save_options | grep -i 'referer:'

1. 2025-12-31Disclosure

   disclosure

1. Reserviert2025-10-07
2. Veröffentlicht2025-12-31
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-62120 is to upgrade to a patched version of the OpenHook plugin as soon as it becomes available. Until a patch is released, consider implementing additional security measures. These include restricting access to sensitive plugin settings through role-based access control within WordPress. Implementing a Content Security Policy (CSP) can also help mitigate CSRF attacks by restricting the sources from which the browser can load resources. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of defense.

Aktive Installationen

1KNische

Plugin-Bewertung