Reuters Direct <= 3.0.0 - 跨站请求伪造可重置设置

The primary impact of this CSRF vulnerability is the potential for unauthorized modification of the Reuters Direct plugin's settings. An attacker could leverage this to alter configurations, potentially impacting the plugin's functionality or introducing malicious behavior. While the plugin itself may not directly expose sensitive data, changes to its settings could indirectly affect the broader WordPress site's security posture. The attack requires the administrator to click a malicious link, making social engineering a key component of exploitation. This vulnerability is similar to other CSRF flaws where an attacker can perform actions on behalf of an authenticated user without their knowledge.

WordPress sites utilizing the Reuters Direct plugin, particularly those with site administrators who are susceptible to social engineering attacks, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources could also be affected, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'class-reuters-direct-settings.php' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep reuters-direct

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=reuters_direct_settings_save&nonce=malicious_nonce | head -n 1

1. 2025-11-27Disclosure

   disclosure

1. 已保留2025-10-31
2. 发布日期2025-11-27
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The recommended mitigation is to immediately upgrade the Reuters Direct plugin to a version that addresses this vulnerability. The vendor has not yet released a fixed version, so temporary workarounds include restricting access to the 'class-reuters-direct-settings.php' page using WordPress access control plugins. Implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review WordPress user permissions to ensure only authorized personnel have access to plugin settings.