CVE-2025-58200

The Flexible FAQ plugin for WordPress, versions 0.2 and earlier, contains a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is a lack of CSRF protection mechanisms on sensitive actions, allowing attackers to trick authenticated users into performing unintended operations [1].

Exploitation requires user interaction: a privileged user must click a malicious link, visit a crafted page, or submit a form. No special privileges on the attacker's part are needed beyond the ability to craft a malicious web page or email [1].

If exploited, a malicious actor can force higher-privileged users (e.g., admins) to execute unwanted actions under their current authentication session. This could include modifying plugin settings or performing other state-changing operations without the victim's consent [1].

As of the advisory, users are advised to update the plugin immediately. If an update is not available, a workaround is to disable the plugin until a patch is released or contact the hosting provider for assistance [1].