CVE-2025-53568

Vulnerability

Overview The Radio Station plugin for WordPress, versions up to 2.5.12, contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises from insufficient validation of request origins, allowing an attacker to forge requests on behalf of an authenticated administrator [1].

Exploitation

Prerequisites Exploitation requires user interaction: a privileged user must be tricked into clicking a malicious link, visiting a crafted page, or submitting a form while authenticated. No direct network access to the victim is needed; the attacker can deliver the payload via email, social engineering, or other means [1].

Impact

Successful exploitation enables an attacker to force the victim to perform unintended actions, such as modifying plugin settings, creating unauthorized users, or injecting malicious content, all under the victim's current session [1].

Mitigation

The vulnerability is patched in version 2.5.13. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins [1].