CVE-2025-67625: 
WordPress vulnerability analysis and mitigation

CVE-2025-67625 is a Cross-Site Request Forgery (CSRF) vulnerability in the Trade Runner WordPress plugin by tmtraderunner, affecting all versions up to and including 3.14. The vulnerability was published on December 24, 2025, and was discovered and reported by Patchstack. It carries a CVSS v3.1 base score of 8.8 (High), reflecting network-based exploitation requiring user interaction but no privileges (Feedly, Red Hat CVE).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), indicating that the Trade Runner plugin fails to properly validate or enforce anti-CSRF tokens on state-changing requests. An attacker can craft a malicious web page or link that, when visited by an authenticated Trade Runner user, silently submits forged HTTP requests to the plugin's endpoints on the victim's behalf. Exploitation requires no privileges on the part of the attacker and relies solely on the victim being logged into a WordPress site with the Trade Runner plugin installed and active (Feedly).

Successful exploitation allows an attacker to perform unauthorized administrative actions on behalf of an authenticated user without their knowledge or consent. This can include modifying plugin settings, creating or deleting trading-related data, or executing other privileged operations within the Trade Runner application. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, meaning a successful attack could result in data exposure, data manipulation, or disruption of the plugin's functionality (Feedly).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-67625. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites running the Trade Runner plugin (version ≤ 3.14) using tools like WPScan or by inspecting publicly accessible WordPress plugin directories.
2. Craft malicious request: Analyze the Trade Runner plugin's state-changing endpoints (e.g., settings update or data management forms) to identify requests that lack CSRF token validation.
3. Create forged payload: Build a malicious HTML page containing a hidden form or JavaScript that automatically submits a forged POST request to the target WordPress site's Trade Runner endpoint with attacker-controlled parameters.
4. Deliver to victim: Trick an authenticated Trade Runner administrator or user into visiting the malicious page via phishing email, social engineering, or a compromised website.
5. Achieve objective: The victim's browser automatically sends the forged request with their valid session cookies, causing the Trade Runner plugin to execute the unauthorized action (e.g., modifying settings or deleting data) on the attacker's behalf (Feedly).

• Logs: WordPress access logs showing unexpected POST requests to Trade Runner plugin endpoints from unusual referrer URLs or with no referrer header; repeated state-changing requests in short succession from a single authenticated session.
• Application: Unexplained changes to Trade Runner plugin settings, unexpected creation or deletion of trading data, or administrative actions not initiated by the legitimate user.
• Network: HTTP requests to Trade Runner plugin endpoints originating from external or unfamiliar referrer domains, particularly those not associated with the WordPress admin panel.

Users should update the Trade Runner plugin to the latest available version beyond 3.14, which is reported to contain a patch for this vulnerability (Feedly). If an immediate update is not possible, administrators should restrict access to the WordPress admin panel using IP allowlisting, enforce strict referrer checking at the web server or WAF level, and ensure the SameSite=Strict or SameSite=Lax attribute is set on session cookies. Users should also be cautioned against clicking unsolicited links while logged into WordPress.