Foxtool All-in-One: Bouton de chat contact, Connexion personnalisée, Optimisation des images média <= 2.5.2 - Cross-Site Request Forgery vers la connexion Google OAuth

The primary impact of this CSRF vulnerability lies in the potential for unauthorized OAuth connection establishment. An attacker could craft a malicious link or embed it within a website or email, enticing a site administrator to click it. Upon clicking, the attacker could forge a request, effectively granting them access to the administrator's account and potentially compromising sensitive data or performing actions on behalf of the administrator. This could lead to unauthorized access to user information, modification of site content, or even complete control over the WordPress site, depending on the permissions associated with the administrator's account. The risk is amplified if the OAuth connection is linked to other services or APIs, potentially extending the attacker's reach beyond the WordPress site itself.

WordPress sites utilizing the Foxtool All-in-One plugin, particularly those with site administrators who frequently interact with OAuth-connected services, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to the exploitation of others.

• wordpress / composer / npm:

grep -r 'foxtool_login_google()' /var/www/html/wp-content/plugins/foxtool-all-in-one/

• wordpress / composer / npm:

wp plugin list | grep foxtool-all-in-one

• wordpress / composer / npm:

wp plugin update foxtool-all-in-one

1. 2025-12-12Disclosure

   disclosure

1. Réservé2025-11-19
2. Publiée2025-12-12
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-13408 is to immediately upgrade the Foxtool All-in-One plugin to version 2.5.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and output encoding practices within the plugin's code to prevent the exploitation of the missing nonce validation. Additionally, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Educate administrators about the risks of clicking on suspicious links and encourage them to verify the authenticity of any requests before performing actions. After upgrading, confirm the fix by attempting to trigger the vulnerable function (foxtoollogingoogle()) with a forged request and verifying that the action is blocked.

Installations actives

7KNiche

Note du plugin