CVE-2025-62880: 
WordPress vulnerability analysis and mitigation

CVE-2025-62880 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Custom 404 Pro by Kunal Nagar, affecting all versions through 3.12.0. The flaw allows unauthenticated attackers to forge requests that cause privileged users to execute unwanted actions on affected WordPress sites. It was reported by researcher TaiYou on April 13, 2025, published by Patchstack on May 13, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from missing or insufficient nonce/token validation on one or more plugin actions within Custom 404 Pro. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, silently submits a forged request to the plugin's endpoints — performing state-changing operations without the user's knowledge or consent. No authentication is required on the attacker's side; the attack relies entirely on the victim's active session. No public PoC code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to force a higher-privileged WordPress user (e.g., an administrator) to perform unauthorized actions within the Custom 404 Pro plugin, such as modifying plugin settings or 404 redirect configurations. The primary impact is on integrity (CVSS integrity impact: Low), with no direct confidentiality or availability impact. While the individual impact is limited, mass-exploit campaigns targeting WordPress plugins of this type can affect thousands of sites simultaneously regardless of their traffic or popularity (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-62880. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though CSRF vulnerabilities in WordPress plugins are sometimes included in mass-scanning campaigns (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Custom 404 Pro plugin at version 3.12.0 or earlier, using tools like WPScan or passive enumeration of plugin directories.
2. Craft malicious payload: Create an HTML page or hidden form that submits a forged POST/GET request to the vulnerable Custom 404 Pro plugin endpoint (e.g., a settings-update action), without requiring a valid CSRF nonce.
3. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page — via phishing email, social engineering, or embedding the payload in a comment or external site.
4. Trigger forged action: When the administrator's browser loads the attacker's page, it automatically submits the forged request using the victim's active session cookies, causing the plugin to execute the unauthorized action (e.g., altering 404 redirect settings).
5. Achieve objective: The plugin processes the request as legitimate, modifying site behavior according to the attacker's crafted parameters (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Custom 404 Pro plugin admin endpoints (e.g., wp-admin/admin-post.php or wp-admin/options.php) from unusual referrer origins or with no referrer header.
• File System: Unexpected changes to Custom 404 Pro plugin configuration or database entries (e.g., altered 404 redirect rules in wp_options table) without corresponding administrator activity.
• Logs: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording settings changes attributed to an administrator account at unusual times or from unfamiliar IP addresses.

The vendor has released version 3.12.1 of Custom 404 Pro, which patches this vulnerability. All site administrators running version 3.12.0 or earlier should update immediately via the WordPress plugin dashboard or by downloading the patched version from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating to 3.12.1 is the only recommended remediation (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Active VDP (Vulnerability Disclosure Program), with researcher TaiYou credited for the report. Patchstack classifies it as low priority with no impactful threat, and the broader security community has not produced notable commentary or media coverage beyond standard vulnerability aggregator listings (Patchstack).