CVE-2025-12578: CSRF in Reuters Direct WordPress Plugin

The primary impact of this CSRF vulnerability is the potential for unauthorized modification of the Reuters Direct plugin's settings. An attacker could leverage this to alter configurations, potentially impacting the plugin's functionality or introducing malicious behavior. While the plugin itself may not directly expose sensitive data, changes to its settings could indirectly affect the broader WordPress site's security posture. The attack requires the administrator to click a malicious link, making social engineering a key component of exploitation. This vulnerability is similar to other CSRF flaws where an attacker can perform actions on behalf of an authenticated user without their knowledge.

1. Reserved2025-10-31
2. Published2025-11-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade the Reuters Direct plugin to a version that addresses this vulnerability. The vendor has not yet released a fixed version, so temporary workarounds include restricting access to the 'class-reuters-direct-settings.php' page using WordPress access control plugins. Implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review WordPress user permissions to ensure only authorized personnel have access to plugin settings.