CVE-2025-60156: 
WordPress vulnerability analysis and mitigation

CVE-2025-60156 is a Cross-Site Request Forgery (CSRF) vulnerability in the AR For WordPress plugin by webandprint that enables an attacker to upload a malicious web shell to the web server. It affects AR For WordPress versions up to and including 8.39 (with some sources citing ≤ 7.98 or ≤ 8.34 depending on the reporting database). The vulnerability was reported by Abu Hurayra on July 26, 2025, and publicly disclosed on September 26, 2025. It carries a CVSS v3.1 base score of 9.6 (Critical) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from the plugin's failure to implement adequate CSRF token validation on file upload functionality, allowing an unauthenticated attacker to craft a malicious request that, when executed by an authenticated administrator, uploads a web shell to the server. The attack vector is network-based, requires no privileges from the attacker, but does require user interaction — specifically, a privileged WordPress user must be tricked into visiting a crafted page or clicking a malicious link. The exploitation technique maps to CAPEC-62 (Cross Site Request Forgery) and could result in arbitrary file upload leading to remote code execution (Patchstack, Red Hat CVE).

Successful exploitation allows an attacker to upload a malicious web shell to the WordPress server, effectively achieving remote code execution under the web server's process context. This can lead to complete compromise of the WordPress site, unauthorized access to sensitive data (databases, credentials, user information), and potential lateral movement within the hosting environment. The scope is marked as "Changed" in the CVSS vector, indicating that the impact extends beyond the vulnerable plugin itself to the broader web server and potentially the underlying host (Patchstack, Red Hat CVE).

As of the disclosure date, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in its weekly vulnerability bulletin for the week of September 22, 2025. Patchstack rates the practical exploitation priority as "Low" despite the high CVSS score, noting the requirement for user interaction as a significant barrier (Patchstack).

1. Reconnaissance: Identify WordPress sites running the AR For WordPress plugin (versions ≤ 8.39) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Craft malicious page: Create an attacker-controlled web page containing a hidden HTML form that submits a file upload request to the target WordPress site's vulnerable plugin endpoint, embedding a PHP web shell as the uploaded file.
3. Social engineering: Deliver the malicious page URL to a WordPress administrator via phishing email, comment, or other social engineering vector, inducing them to visit the page while authenticated to their WordPress dashboard.
4. CSRF trigger: When the authenticated administrator visits the attacker's page, the browser automatically submits the forged form request to the WordPress site, bypassing CSRF protections due to the missing token validation in the plugin.
5. Web shell access: The uploaded PHP web shell is placed in a web-accessible directory on the server; the attacker then directly accesses the shell URL to execute arbitrary commands on the server (Patchstack).

• File System: Unexpected PHP files (e.g., .php files with names like shell.php, cmd.php, upload.php) in the AR For WordPress plugin upload directories or other web-accessible paths; files with obfuscated PHP code (e.g., eval(base64_decode(...))).
• Network: Unusual outbound connections from the web server process to external IPs; HTTP requests to newly created PHP files in plugin directories from unfamiliar IP addresses.
• Logs: WordPress access logs showing POST requests to AR For WordPress plugin endpoints from unexpected referrers or with unusual Content-Type: multipart/form-data payloads; web server access logs showing GET/POST requests to newly created PHP files not part of the original plugin installation.
• Process: Unexpected child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, sh, curl, wget, or python executing system commands.

As of the disclosure date, no official patch is available from the plugin developer for AR For WordPress (Patchstack). Recommended immediate actions include:

• Disable or remove the AR For WordPress plugin until a patched version is released.
• Deploy a Web Application Firewall (WAF) with CSRF protection rules (Patchstack's virtual patching can provide protection without code changes).
• Restrict administrative access to the WordPress dashboard by IP allowlisting where feasible.
• Monitor file system for unexpected PHP files in plugin directories.
• Educate administrators to avoid clicking unsolicited links while logged into WordPress.

The vulnerability was noted in CISA's weekly vulnerability bulletin (SB25-272) for the week of September 22, 2025, indicating it reached the attention of U.S. government cybersecurity authorities (CISA Bulletin). Security community accounts on Bluesky and Mastodon (infosec.exchange) shared the vulnerability details shortly after disclosure. Patchstack, which discovered and reported the issue, classified it as low practical priority despite the critical CVSS score, emphasizing the user-interaction requirement as a meaningful exploitation barrier (Patchstack).