Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. <br>📉 **Priority**: **P0**. <br>💡 **Reason**: CVSS Score **9.6**, public PoC exists, and it leads directly to **RCE**. Do not delay patching or mitigation.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: A **CSRF** vulnerability in the WordPress plugin allows attackers to force users to execute unintended actions.
💥 **Consequences**: This leads to **Remote Code Execution (RCE)**.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **CWE-352** (Cross-Site Request Forgery).
🔍 **Flaw**: The plugin fails to validate the origin of POST requests.…

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected Product**: **Custom CSS, JS & PHP** plugin by **WPFactory**.
📅 **Versions**: All versions **up to and including 2.4.1**.
🌐 **Platform**: WordPress sites running this specific plugin version.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

💻 **Attacker Capabilities**:
1. **Execute Arbitrary Code**: Inject PHP scripts via the plugin's interface.
2. **Full System Compromise**: Achieve **Remote Code Execution (RCE)**.
3.…

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

⚠️ **Exploitation Threshold**: **Low**.
🔑 **Auth**: Requires **Privileges: None (PR:N)** for the attacker, but **User Interaction (UI:R)** is needed (e.g., tricking an admin into clicking a link).…

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🔓 **Public Exploit**: **YES**.
📂 **PoC Available**: A Proof of Concept is publicly available on GitHub (`Nxploited/CVE-2025-39601`).…

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**:
1. **Scan**: Use vulnerability scanners to detect **WPFactory Custom CSS, JS & PHP** version <= 2.4.1.
2.…

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

🩹 **Official Fix**: **YES**.
📢 **Action**: Update the **Custom CSS, JS & PHP** plugin to a version **newer than 2.4.1**.…

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch Workaround**:
1. **Disable**: Deactivate and delete the plugin if not strictly needed.
2. **Restrict**: Limit admin access to trusted IPs only.
3.…

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🚨 **Urgency**: **CRITICAL / IMMEDIATE ACTION REQUIRED**.
📉 **Priority**: **P0**.
💡 **Reason**: CVSS Score **9.6**, public PoC exists, and it leads directly to **RCE**. Do not delay patching or mitigation.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-39601 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring