CVE-2025-6059: 
WordPress vulnerability analysis and mitigation

The Seraphinite Accelerator plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.27.21, discovered and disclosed on June 13, 2025. The vulnerability affects the 'OnAdminApi_CacheOpBegin' function due to missing or incorrect nonce validation (NVD, Wiz).

The vulnerability stems from improper nonce validation in the 'OnAdminApi_CacheOpBegin' function. It has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is tracked as CWE-352 (Cross-Site Request Forgery) (NVD).

A successful exploitation of this vulnerability allows unauthenticated attackers to perform several administrative actions, including deleting the cache, through forged requests. The attack requires social engineering as the attacker must trick a site administrator into performing an action such as clicking on a malicious link (NVD, Wiz).

Users are advised to update to a version newer than 2.27.21 when available. The vulnerability has been fixed in version 2.27.22 which adds proper nonce validation (Wiz).