CVE-2025-47523

Vulnerability

Overview

The Seznam Webmaster plugin for WordPress (versions up to and including 1.4.7) contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises from insufficient CSRF protection mechanisms, enabling an attacker to trick authenticated users into performing unintended actions without their consent [1].

Exploitation

Details

Exploitation requires user interaction: a privileged user must click a malicious link, visit a crafted page, or submit a form while authenticated to the WordPress admin area. The attacker does not need direct access to the site but can leverage social engineering to trigger the forged request [1].

Impact

Successful exploitation allows an attacker to force higher privileged users (e.g., administrators) to execute unwanted actions under their current session. This could lead to unauthorized changes in plugin settings or other administrative operations, potentially compromising site integrity [1].

Mitigation

The vulnerability has been addressed in version 1.4.8 of the plugin. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to ensure timely protection [1].