CVE-2025-60113: 
WordPress vulnerability analysis and mitigation

CVE-2025-60113 is a Cross-Site Request Forgery (CSRF) vulnerability in the Groovy Menu WordPress plugin (by grooni), affecting all versions up to and including 1.4.3. The vulnerability was published on September 26, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, EUVD).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate the origin of state-changing requests. An unauthenticated remote attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (e.g., an administrator), triggers unauthorized actions on the target site without the victim's knowledge. Exploitation requires no special privileges but does require user interaction — specifically, a logged-in user must be tricked into visiting a malicious URL or page (Red Hat CVE, Patchstack).

Successful exploitation allows an attacker to perform unauthorized state-changing actions on the WordPress site on behalf of an authenticated user, resulting in a low integrity impact with no confidentiality or availability impact. Depending on the privileges of the targeted user, this could include modifying plugin settings or menu configurations. The scope is unchanged, limiting the blast radius to the affected WordPress installation (Red Hat CVE).

There is no known public exploit code or evidence of active in-the-wild exploitation for CVE-2025-60113 at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE, EUVD).

1. Reconnaissance: Identify WordPress sites running the Groovy Menu plugin (groovy-menu-free) at version 1.4.3 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Craft malicious request: Identify a state-changing action within the Groovy Menu plugin (e.g., saving menu settings) that lacks CSRF token validation.
3. Create CSRF payload: Build a malicious HTML page containing a form or JavaScript that automatically submits a forged request to the target WordPress site's admin endpoint for the vulnerable action.
4. Social engineering: Deliver the malicious page link to an authenticated WordPress administrator via phishing email, comment, or other social engineering vector.
5. Trigger exploitation: When the authenticated admin visits the malicious page, their browser automatically submits the forged request, causing the plugin to execute the unauthorized action on their behalf (Red Hat CVE, Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Groovy Menu plugin admin endpoints (e.g., /wp-admin/admin-ajax.php or plugin-specific action URLs) from unusual referrer origins or with missing/invalid nonce values.
• Application: Unexpected changes to Groovy Menu plugin settings or menu configurations without corresponding administrator activity.
• Network: Requests to WordPress admin endpoints originating from external or unexpected referrer domains, particularly those lacking a valid WordPress nonce in the request body.

Users should update the Groovy Menu plugin to a version beyond 1.4.3 that includes a fix for this CSRF vulnerability; check the WordPress plugin repository for the latest patched release. As a temporary workaround, administrators can restrict access to the WordPress admin panel by IP allowlisting or by using a Web Application Firewall (WAF) rule to block cross-origin requests to admin endpoints. Ensuring that only trusted users have administrator-level access to the WordPress site also reduces the risk of successful exploitation (Patchstack, Red Hat CVE).