CVE-2025-64239: 
WordPress vulnerability analysis and mitigation

CVE-2025-64239 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress RTL Tester plugin developed by Yoav Farhi. It affects all versions of the plugin up to and including version 1.2, with no official patch currently available. The vulnerability was reported by Nabil Irawan on November 11, 2025, and published by Patchstack on December 11–16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to implement adequate anti-CSRF token validation on one or more of its state-changing requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, silently submits a forged request to the plugin's endpoint on their behalf. No special privileges are required by the attacker, but user interaction (e.g., clicking a link or visiting a crafted page) is necessary for exploitation. The vulnerability maps to OWASP Top 10 category A1: Broken Access Control (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions within the RTL Tester plugin under their current authentication session. The primary impact is on integrity — an attacker could manipulate plugin settings or trigger plugin functionality without the victim's knowledge. Confidentiality and availability impacts are assessed as low to none, limiting the overall severity, though the attack could be chained with other vulnerabilities for greater effect (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though CSRF vulnerabilities in WordPress plugins are sometimes leveraged in mass-exploit campaigns targeting large numbers of sites indiscriminately (Patchstack).

1. Reconnaissance: Identify WordPress sites running the RTL Tester plugin version 1.2 or earlier, using tools like WPScan or by inspecting publicly accessible WordPress plugin directories.
2. Craft malicious payload: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged HTTP request to the RTL Tester plugin's vulnerable endpoint (e.g., an admin settings action), targeting the specific plugin action that lacks CSRF protection.
3. Deliver the payload: Trick an authenticated WordPress administrator into visiting the malicious page via phishing email, social engineering, or embedding the payload in a comment or external link.
4. Trigger forged action: When the victim's browser loads the attacker's page, the hidden form auto-submits the request using the victim's active session cookies, causing the plugin to execute the attacker-specified action without the victim's consent (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to RTL Tester plugin admin endpoints (e.g., wp-admin/admin-post.php or wp-admin/options.php) from unusual referrer origins or with no referrer header.
• Logs: Admin action logs (if audit logging is enabled) recording plugin setting changes at unusual times or from unexpected IP addresses.
• Network: HTTP requests to WordPress admin URLs related to the RTL Tester plugin originating from external or unfamiliar domains in the Referer header.

As of the time of publication, no official patch is available for the RTL Tester plugin (versions ≤ 1.2). Site administrators are advised to deactivate and remove the plugin until a patched version is released. As a workaround, web application firewalls (WAFs) with CSRF protection rules — such as those provided by Patchstack, Wordfence, or similar solutions — can help block exploitation attempts. Administrators should monitor the WordPress plugin repository and the developer's page for an updated release (Patchstack).