WordPress WP SEO Search plugin <= 1.1 - Vulnerabilidade de Cross Site Request Forgery (CSRF)

A successful CSRF attack could allow an attacker to modify site settings, publish content, or perform other actions as the logged-in user without their knowledge or consent. The impact is directly tied to the privileges of the user whose account is targeted. If an administrator's account is compromised, the attacker could gain full control over the WordPress site. This vulnerability highlights the importance of proper input validation and output encoding to prevent malicious requests from being executed.

Websites using the WP SEO Search plugin, particularly those with administrator accounts that are frequently targeted or have weak passwords, are at risk. Shared WordPress hosting environments where multiple sites share the same server resources are also potentially more vulnerable.

• wordpress / composer / npm:

wp plugin list | grep wp-seo-search

• wordpress / composer / npm:

wp plugin update --all

• wordpress / composer / npm:

wp plugin status wp-seo-search

• generic web: Check for unusual activity in WordPress admin logs, specifically POST requests to plugin endpoints.

1. 2026-01-22Disclosure

   disclosure

1. Reservado2025-12-09
2. Publicada2026-01-22
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-67626 is to immediately upgrade the WP SEO Search plugin to version 1.2 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the origins from which scripts can be executed. Additionally, using a WordPress security plugin with CSRF protection can provide an additional layer of defense. After upgrading, verify the plugin's functionality and ensure no unexpected behavior occurs.

Instalações ativas

100

Avaliação do plugin