CVE-2025-48099: 
WordPress vulnerability analysis and mitigation

CVE-2025-48099 is a Cross-Site Request Forgery (CSRF) vulnerability in the Code Amp "Search & Filter" WordPress plugin that can be chained to perform an open redirect attack. It affects all versions of the plugin up to and including 1.2.17, with version 1.2.18 containing the fix. The vulnerability was reported by researcher "ni gensho" on July 25, 2025, and published by Patchstack on October 7, 2025, with NVD publication on October 22, 2025. It carries a CVSS v3.1 base score of 4.7 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and arises from insufficient or absent CSRF token validation in the Search & Filter plugin's request handling logic. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers an unauthorized state-changing request on behalf of that user. The specific attack chain described is CSRF leading to an open redirect, meaning the forged request can redirect the victim's browser to an attacker-controlled URL. No authentication is required on the attacker's side, but user interaction (e.g., clicking a malicious link) is necessary for exploitation (Patchstack).

Successful exploitation allows an attacker to force a higher-privileged WordPress user to unknowingly execute unwanted actions, including being redirected to an attacker-controlled external URL. The primary impact is a low confidentiality exposure (e.g., leaking the victim's session context to a third-party site via open redirect) with no direct integrity or availability impact as scored. While the individual vulnerability is rated low severity, it could be leveraged in phishing campaigns or as part of a broader attack chain targeting WordPress site administrators (Patchstack).

There is no known public proof-of-concept exploit code or evidence of active in-the-wild exploitation for CVE-2025-48099. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Search & Filter plugin (by Code Amp) at version 1.2.17 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTML page or link containing a forged form or GET request targeting the vulnerable Search & Filter plugin endpoint that handles redirect or configuration actions, without a valid CSRF nonce.
3. Social engineering: Deliver the malicious link or page to an authenticated WordPress user (e.g., administrator or editor) via email, comment, or other channel, enticing them to click or visit the page.
4. Trigger CSRF: When the victim's browser loads the attacker's page, it automatically submits the forged request to the target WordPress site using the victim's active session cookies.
5. Open redirect execution: The plugin processes the forged request and redirects the victim's browser to an attacker-specified external URL, which can be used for phishing, credential harvesting, or session token theft (Patchstack).

• Logs: WordPress access logs showing unexpected requests to Search & Filter plugin endpoints originating from unusual referrer URLs or external domains; requests lacking valid WordPress nonce parameters.
• Network: Outbound redirects from the WordPress server to unfamiliar or suspicious external domains following plugin endpoint requests; unusual HTTP 302 responses from plugin-related URLs.
• User Reports: Authenticated users reporting unexpected browser redirects to external sites after interacting with WordPress admin or front-end pages.

The vendor has released version 1.2.18 of the Search & Filter plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.2.18 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area to trusted IP addresses. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability intelligence report for the period of October 6–12, 2025, indicating routine tracking by the WordPress security community. No significant vendor statements, notable researcher commentary beyond the Patchstack disclosure, or major media coverage have been identified for this vulnerability.