CVE-2025-62739: CSRF in SaifuMak Add Custom Codes

This CSRF vulnerability allows an attacker to trick an authenticated user into unknowingly performing actions they did not intend. For example, an attacker could craft a malicious link that, when clicked by a logged-in user, modifies settings, creates new content, or performs other actions within the Add Custom Codes plugin. The blast radius is limited to the user's privileges within the WordPress site, but a site administrator's account could lead to significant compromise. Successful exploitation requires the user to be logged in and interact with the malicious link.

1. Reserved2025-10-21
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade SaifuMak Add Custom Codes to version 5.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Content Security Policy (CSP) to restrict the sources from which scripts can be executed. Additionally, implement strict input validation and output encoding to minimize the impact of any potential CSRF attempts. Monitor WordPress access logs for suspicious requests originating from unfamiliar sources.

Active installs

1KNiche

Plugin rating