CVE-2025-67596: 
WordPress vulnerability analysis and mitigation

CVE-2025-67596 is a Cross-Site Request Forgery (CSRF) vulnerability in the Business Directory Plugin for WordPress, developed by Strategy11 Team. It affects all versions of the plugin up to and including 6.4.19. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or verify the origin of state-changing HTTP requests. An unauthenticated remote attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, causes the victim's browser to submit unauthorized requests to the vulnerable plugin endpoint. Exploitation requires user interaction — specifically, a logged-in user must be tricked into visiting an attacker-controlled page. The limited confidentiality impact (low) and no integrity or availability impact suggest the CSRF can be leveraged to trigger read-type actions rather than full data modification (Feedly).

Successful exploitation results in a low confidentiality impact with no direct integrity or availability consequences, as reflected in the CVSS scoring. An attacker who tricks an authenticated user into triggering the CSRF request may be able to access or expose limited information through the Business Directory plugin. The scope is limited to the affected WordPress installation and does not indicate lateral movement potential or significant data exfiltration risk (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67596. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016%, indicating a very low probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify WordPress sites running the Business Directory Plugin version 6.4.19 or earlier, using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Craft malicious request: Analyze the plugin's CSRF-vulnerable endpoint to identify the specific action or form that lacks nonce validation.
3. Create exploit page: Build a malicious HTML page containing a hidden form or JavaScript that automatically submits a forged HTTP request to the target WordPress site's vulnerable endpoint.
4. Social engineering: Deliver the malicious link or page to an authenticated WordPress user (e.g., administrator or editor) via phishing email, comment, or other social engineering vector.
5. Trigger CSRF: When the victim visits the attacker's page while logged into the target WordPress site, their browser automatically sends the forged request with their session credentials, executing the unauthorized action on the plugin (Feedly).

Users should update the Business Directory Plugin to a version beyond 6.4.19, which addresses the missing CSRF protection. As a general WordPress hardening measure, administrators should ensure users avoid clicking unsolicited links while authenticated to the WordPress dashboard. Implementing a Web Application Firewall (WAF) with CSRF detection rules can provide an additional layer of defense while patching is pending (Patchstack).