CVE-2025-67591: 
WordPress vulnerability analysis and mitigation

CVE-2025-67591 is a Cross-Site Request Forgery (CSRF) vulnerability in the JNews Paywall WordPress plugin developed by jegtheme. It affects all versions of the plugin from n/a through versions earlier than 12.0.1. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or enforce anti-CSRF tokens on one or more state-changing requests. An unauthenticated remote attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), causes the victim's browser to submit unauthorized requests to the vulnerable plugin endpoint. No special privileges are required by the attacker, but user interaction is necessary for exploitation (Feedly).

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an authenticated user against a WordPress site running the vulnerable JNews Paywall plugin. Based on the CVSS scoring, the primary impact is limited confidentiality exposure (low), with no direct integrity or availability impact reported. However, depending on the specific actions exposed to CSRF, an attacker could potentially manipulate paywall settings, subscription configurations, or other plugin-controlled functionality on the affected WordPress installation (Feedly).

There is no known public exploit code or evidence of active in-the-wild exploitation for CVE-2025-67591 at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016%, indicating a very low probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify WordPress sites using the JNews Paywall plugin (versions < 12.0.1) via passive reconnaissance, plugin enumeration tools, or public search engines.
2. Craft malicious request: Identify the specific plugin endpoint(s) that perform state-changing actions without CSRF token validation (e.g., paywall configuration updates).
3. Create CSRF payload: Build a malicious HTML page containing a hidden form or JavaScript that automatically submits a forged request to the target WordPress site's vulnerable endpoint.
4. Deliver to victim: Trick an authenticated WordPress administrator or privileged user into visiting the malicious page via phishing, social engineering, or a compromised third-party site.
5. Action executed: The victim's browser submits the forged request with their session credentials, causing the plugin to execute the unauthorized action (e.g., modifying paywall settings) without the user's knowledge (Feedly).

• Logs: Unexpected or anomalous POST requests to JNews Paywall plugin endpoints in WordPress access logs, particularly from unusual referrer URLs or with no referrer header.
• Application: Unexplained changes to paywall configuration, subscription rules, or plugin settings in the WordPress admin panel without corresponding administrator activity.
• Network: Requests to WordPress AJAX handlers or admin-post.php associated with the jnews-paywall plugin originating from unexpected IP addresses or referrers.

Users should update the JNews Paywall plugin to version 12.0.1 or later, which addresses this CSRF vulnerability. As a general workaround prior to patching, administrators can restrict access to the WordPress admin area using IP allowlisting or require additional authentication layers. Ensuring that only trusted users have administrator-level access to the WordPress site reduces the risk of successful exploitation (Patchstack).