CVE-2025-68082

Vulnerability

Overview

The Semrush Content Toolkit (semrush-contentshake) plugin for WordPress, version 1.1.32 and earlier, is affected by a Cross-Site Request Forgery (CSRF) vulnerability. This flaw stems from insufficient validation of HTTP requests, enabling an attacker to trick an authenticated administrative user into performing unintended actions [1].

Exploitation

Exploitation requires user interaction—an attacker must convince a privileged user (such as an admin) to click a crafted link or visit a malicious page while authenticated to the WordPress site. No additional privileges are required beyond the victim's existing session [1].

Impact

If exploited, an attacker can force the target user to execute state-changing operations under their own authentication, such as modifying plugin settings or performing other undesired actions. This could lead to partial compromise of the affected website's content configuration [1].

Mitigation

The vendor has released version 1.1.33 which fixes the CSRF vulnerability. Users are strongly advised to update immediately [1]. For Patchstack users, enabling auto-updates for vulnerable plugins provides ongoing protection against mass-exploitation campaigns known to target this type of issue [1].