CVE-2025-67598: 
WordPress vulnerability analysis and mitigation

CVE-2025-67598 is a Cross-Site Request Forgery (CSRF) vulnerability in the SupportCandy WordPress plugin developed by PSM Plugins. It affects all versions of SupportCandy through 3.4.1 (inclusive). The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, EUVD).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate that state-changing requests originate from legitimate, authenticated user sessions. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator or support agent), triggers unauthorized actions within the SupportCandy plugin on their behalf. Exploitation requires no privileges on the part of the attacker but does require user interaction — specifically, a logged-in user must be tricked into visiting a malicious URL or page (Feedly, Patchstack).

Successful exploitation of this CSRF vulnerability allows an attacker to perform unauthorized actions within the SupportCandy plugin on behalf of an authenticated user, resulting in a low integrity impact with no direct confidentiality or availability consequences. Depending on the actions exposed without CSRF protection, this could include modifying support ticket data, changing plugin settings, or manipulating helpdesk workflows. The scope is limited to the affected WordPress installation and does not directly enable lateral movement or sensitive data exfiltration (Feedly).

There is no public evidence of active in-the-wild exploitation of CVE-2025-67598 at this time, and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No public proof-of-concept exploit code has been identified. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify a target WordPress site running SupportCandy version 3.4.1 or earlier, which can be detected via plugin enumeration tools or by inspecting publicly accessible WordPress metadata.
2. Identify vulnerable action: Determine which SupportCandy plugin actions (e.g., ticket management, settings changes) lack CSRF token validation by reviewing plugin source code or observing HTTP requests made by authenticated users.
3. Craft malicious request: Create an HTML page or form that automatically submits a forged HTTP request to the target WordPress site's SupportCandy endpoint, mimicking a legitimate action (e.g., deleting a ticket or changing a setting).
4. Deliver to victim: Trick an authenticated SupportCandy user (e.g., an admin or support agent) into visiting the malicious page via phishing, a crafted link, or an embedded iframe.
5. Action executed: The victim's browser automatically sends the forged request with their valid session cookies, causing the SupportCandy plugin to execute the unauthorized action on their behalf (Feedly).

Users should update the SupportCandy WordPress plugin to a version beyond 3.4.1 that includes CSRF protection fixes. Until a patched version is available or applied, administrators can reduce risk by limiting access to the WordPress admin panel and SupportCandy functionality to trusted networks or IP ranges. Additionally, enforcing strict browser security policies (e.g., SameSite cookie attributes) at the server or CDN level can help mitigate CSRF risks as a temporary measure (Feedly, Patchstack).