CVE-2025-49373: 
WordPress vulnerability analysis and mitigation

CVE-2025-49373 is a Cross-Site Request Forgery (CSRF) vulnerability in the Evergreen Content Poster WordPress plugin, affecting all versions up to and including 1.4.5. The vulnerability was reported by researcher Mika on June 12, 2025, and published by Patchstack on July 12, 2025; it was assigned a CVE and added to NVD on October 22, 2025. The patched version is 1.4.6. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate the origin of state-changing HTTP requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), causes the victim's browser to submit unauthorized requests to the plugin's endpoints on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated to the WordPress site (Patchstack).

Successful exploitation allows an attacker to force higher-privileged WordPress users to execute unwanted actions within the Evergreen Content Poster plugin under their current authentication context, resulting in a low integrity impact. There is no confidentiality or availability impact associated with this vulnerability. The practical effect is limited to unauthorized modifications to plugin-controlled content or settings, such as altering scheduled or evergreen post configurations (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, though the severity and impact of this specific issue are rated low (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Evergreen Content Poster plugin at version 1.4.5 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Identify the plugin's state-changing action endpoints (e.g., form submission handlers for managing evergreen posts) that lack CSRF token validation.
3. Create a CSRF payload: Build a malicious HTML page containing a hidden form or auto-submitting JavaScript that targets the vulnerable plugin endpoint with attacker-chosen parameters.
4. Deliver to victim: Trick an authenticated WordPress administrator or editor into visiting the malicious page (e.g., via phishing email or a compromised external site).
5. Achieve unauthorized action: The victim's browser automatically submits the forged request with their session credentials, causing the plugin to execute the attacker-specified action (e.g., modifying or deleting evergreen post schedules) (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Evergreen Content Poster plugin endpoints from unusual referrer origins or with no referrer header, particularly from authenticated sessions.
• Application: Unexplained changes to evergreen post schedules, settings, or content managed by the Evergreen Content Poster plugin without corresponding administrator activity.
• Network: Requests to WordPress admin-ajax.php or plugin-specific action URLs originating from external or unexpected referrer domains.

The vendor has released version 1.4.6 of the Evergreen Content Poster plugin, which resolves this vulnerability. Site administrators should update to version 1.4.6 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting access to the WordPress admin area via IP allowlisting or disabling the plugin temporarily can reduce exposure (Patchstack).