WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery para Stored Cross-Site Scripting

The primary impact of CVE-2025-12589 is the ability for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to various malicious actions, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive information like cookies and login credentials. The attack requires an administrator to be tricked into performing an action, such as clicking a malicious link, making it a CSRF-based XSS. Successful exploitation could severely damage the website's reputation and compromise user accounts.

Websites utilizing the WP-Walla plugin, particularly those with administrator accounts that are not adequately protected against social engineering attacks, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise of one website could lead to the exploitation of this vulnerability on others.

• wordpress / composer / npm:

grep -r 'settings_page_url' /var/www/html/wp-content/plugins/wp-walla/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep wp-walla

• wordpress / composer / npm:

wp plugin auto-update wp-walla

• wordpress / composer / npm:

wp plugin list | grep wp-walla

1. 2025-11-11Disclosure

   disclosure

1. Reservado2025-10-31
2. Publicada2025-11-11
3. Modificada2026-04-08
4. EPSS atualizado2026-03-23

The recommended mitigation for CVE-2025-12589 is to immediately upgrade the WP-Walla plugin to a version containing the security fix. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious parameters or patterns related to the vulnerable settings page. Additionally, carefully review and restrict administrator access to minimize the risk of successful CSRF attacks. After upgrading, verify the fix by attempting to inject a simple JavaScript payload through the plugin's settings page and confirming that it is properly sanitized.