CVE-2025-62102: 
WordPress vulnerability analysis and mitigation

CVE-2025-62102 is a Cross-Site Request Forgery (CSRF) vulnerability in the DoFollow Case by Case WordPress plugin by Apasionados. It affects all versions up to and including 3.5.1, with version 3.6.0 being the patched release. The vulnerability was reported by researcher Nabil Irawan on September 26, 2025, and published by Patchstack on October 26, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from insufficient or absent CSRF token validation on one or more plugin actions within the DoFollow Case by Case plugin. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, triggers unauthorized state-changing requests on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link while authenticated to the WordPress site (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions under their current authentication context, such as modifying plugin settings that control dofollow/nofollow link attributes. The integrity impact is low and scoped to the affected WordPress instance, with no direct confidentiality or availability impact. This type of vulnerability is commonly leveraged in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-62102. The EPSS score is extremely low at approximately 0.008%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

1. Reconnaissance: Identify WordPress sites running the DoFollow Case by Case plugin version 3.5.1 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTML page containing a hidden form or auto-submitting JavaScript that targets the vulnerable plugin action endpoint (e.g., a settings update form) without a valid CSRF nonce.
3. Social engineering: Deliver the malicious link or page to an authenticated WordPress administrator via phishing email, comment, or other social engineering vector.
4. Trigger CSRF: When the administrator visits the crafted page while logged into their WordPress site, the browser automatically submits the forged request with the victim's session credentials, causing the plugin settings to be modified without the victim's knowledge (Patchstack).

• Logs: Unexpected POST requests to WordPress admin endpoints associated with the DoFollow Case by Case plugin (e.g., wp-admin/admin-post.php or wp-admin/options.php) originating from unusual referrers or external domains in the web server access logs.
• Application: Unexplained changes to DoFollow Case by Case plugin settings (e.g., link attribute rules modified without administrator action) visible in the WordPress admin panel.
• Network: Requests to plugin-related admin actions with missing or invalid _wpnonce values in server-side logs.

The vendor has released version 3.6.0 of the DoFollow Case by Case plugin, which resolves this vulnerability. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area to trusted IP addresses (Patchstack).