Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%

CVE-2025-39601 โ€” AI Deep Analysis Summary

CVSS 9.6 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: A **CSRF** vulnerability in the WordPress plugin allows attackers to force users to execute unintended actions. <br>๐Ÿ’ฅ **Consequences**: This leads to **Remote Code Execution (RCE)**.โ€ฆ

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-352** (Cross-Site Request Forgery). <br>๐Ÿ” **Flaw**: The plugin fails to validate the origin of POST requests.โ€ฆ

Q3Who is affected? (Versions/Components)

๐Ÿ“ฆ **Affected Product**: **Custom CSS, JS & PHP** plugin by **WPFactory**. <br>๐Ÿ“… **Versions**: All versions **up to and including 2.4.1**. <br>๐ŸŒ **Platform**: WordPress sites running this specific plugin version.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’ป **Attacker Capabilities**: <br>1. **Execute Arbitrary Code**: Inject PHP scripts via the plugin's interface. <br>2. **Full System Compromise**: Achieve **Remote Code Execution (RCE)**. <br>3.โ€ฆ

Q5Is exploitation threshold high? (Auth/Config)

โš ๏ธ **Exploitation Threshold**: **Low**. <br>๐Ÿ”‘ **Auth**: Requires **Privileges: None (PR:N)** for the attacker, but **User Interaction (UI:R)** is needed (e.g., tricking an admin into clicking a link).โ€ฆ

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ”“ **Public Exploit**: **YES**. <br>๐Ÿ“‚ **PoC Available**: A Proof of Concept is publicly available on GitHub (`Nxploited/CVE-2025-39601`).โ€ฆ

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: <br>1. **Scan**: Use vulnerability scanners to detect **WPFactory Custom CSS, JS & PHP** version <= 2.4.1. <br>2.โ€ฆ

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Official Fix**: **YES**. <br>๐Ÿ“ข **Action**: Update the **Custom CSS, JS & PHP** plugin to a version **newer than 2.4.1**.โ€ฆ

Q9What if no patch? (Workaround)

๐Ÿšง **No Patch Workaround**: <br>1. **Disable**: Deactivate and delete the plugin if not strictly needed. <br>2. **Restrict**: Limit admin access to trusted IPs only. <br>3.โ€ฆ

Q10Is it urgent? (Priority Suggestion)

๐Ÿšจ **Urgency**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. <br>๐Ÿ“‰ **Priority**: **P0**. <br>๐Ÿ’ก **Reason**: CVSS Score **9.6**, public PoC exists, and it leads directly to **RCE**. Do not delay patching or mitigation.