WordPress Mavis HTTPS to HTTP Redirection Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

The primary impact of CVE-2025-58261 stems from the ability to trigger Stored XSS attacks via CSRF. An attacker could craft malicious requests that, when triggered by a legitimate user, execute arbitrary JavaScript code within the user's browser context. This could lead to session hijacking, unauthorized data modification, redirection to phishing sites, or defacement of the website. The stored nature of the XSS means the payload persists even after the initial attack, potentially affecting multiple users over time. The potential for account takeover is significant, allowing attackers to gain control of administrator accounts and further compromise the system.

Websites utilizing the Mavis HTTPS to HTTP Redirection plugin, particularly those with user accounts or sensitive data, are at risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk, as a single compromised installation can affect multiple websites.

• wordpress / plugin:

wp plugin list | grep Mavis HTTPS to HTTP Redirection

• wordpress / plugin: Check plugin version in WordPress admin dashboard. • wordpress / plugin: Examine plugin files for suspicious JavaScript code or XSS vectors. • wordpress / plugin: Review WordPress access logs for unusual requests targeting the plugin’s endpoints.

1. 2025-09-22Disclosure

   disclosure

1. 予約済み2025-08-27
2. 公開日2025-09-22
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

The recommended mitigation for CVE-2025-58261 is to immediately upgrade the Mavis HTTPS to HTTP Redirection plugin to version 1.4.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Content Security Policy (CSP) to restrict the execution of inline scripts and external resources. Additionally, implement strict input validation and output encoding to sanitize user-supplied data. Web Application Firewall (WAF) rules can be configured to detect and block suspicious CSRF requests, although this is not a substitute for patching. After upgrading, confirm the vulnerability is resolved by attempting to trigger a CSRF request and verifying that the expected behavior does not occur.

アクティブインストール数

100

プラグイン評価

3.7

WordPressが必要

2.9+

動作確認済みバージョン

5.5.18