CVE-2025-62120: CSRF in OpenHook WordPress Plugin

The CSRF vulnerability in OpenHook allows an attacker to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify plugin settings, create or delete content, or perform other actions as if they were the authenticated user. The potential impact depends on the permissions granted to the affected user account. This could lead to data modification, unauthorized access, or even complete control over the WordPress site if the user has administrative privileges. The attack surface is broad, as any user of the plugin is potentially vulnerable.

1. Reserved2025-10-07
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-62120 is to upgrade to a patched version of the OpenHook plugin as soon as it becomes available. Until a patch is released, consider implementing additional security measures. These include restricting access to sensitive plugin settings through role-based access control within WordPress. Implementing a Content Security Policy (CSP) can also help mitigate CSRF attacks by restricting the sources from which the browser can load resources. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of defense.

Active installs

1KNiche

Plugin rating