CVE-2025-64240: 
WordPress vulnerability analysis and mitigation

CVE-2025-64240 is a Cross-Site Request Forgery (CSRF) vulnerability in the Freshchat WordPress plugin that allows unauthenticated attackers to force authenticated users into executing unwanted actions. It affects all versions of the Freshchat plugin through and including version 2.3.4. The vulnerability was reported by researcher Nabil Irawan on November 11, 2025, and published by Patchstack on December 11, 2025, with CVE assignment on December 16, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from the Freshchat WordPress plugin's failure to implement adequate CSRF protections — such as nonce verification — on sensitive plugin actions. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, silently submits a forged request to the vulnerable plugin endpoint on the victim's behalf. Exploitation requires user interaction (the victim must visit or interact with attacker-controlled content) but does not require the attacker to be authenticated themselves (Patchstack).

Successful exploitation allows an attacker to force higher-privileged WordPress users to perform unauthorized actions within the Freshchat plugin under their existing authentication context. The primary impact is on integrity (CVSS integrity impact: Low), with no direct confidentiality or availability impact. While the individual impact is limited, Patchstack notes that CSRF vulnerabilities of this type are commonly leveraged in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-64240. The EPSS score is extremely low at approximately 0.008%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Freshchat plugin version 2.3.4 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Identify target action: Determine which plugin-specific administrative actions lack CSRF nonce validation within the Freshchat plugin.
3. Craft malicious request: Create an HTML page or form that auto-submits a forged HTTP request to the vulnerable Freshchat plugin endpoint (e.g., a hidden form targeting the WordPress admin-post or admin-ajax handler used by the plugin).
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the attacker-controlled page via phishing, a malicious link, or a compromised third-party site.
5. Action executed: The victim's browser automatically submits the forged request with their valid session cookies, causing the plugin to execute the unauthorized action on the attacker's behalf (Patchstack).

As of the time of disclosure, no official patched version of the Freshchat WordPress plugin has been released. Site administrators should update the plugin to a patched version as soon as one becomes available. In the interim, consider deactivating and removing the plugin if it is not critical to operations, or consult your hosting provider or web developer for assistance. Patchstack users may benefit from virtual patching protection provided by the Patchstack platform (Patchstack).