CVE-2025-67626: 
WordPress vulnerability analysis and mitigation

CVE-2025-67626 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP SEO Search WordPress plugin developed by Angel Costa. It affects all versions of the plugin from n/a through 1.1 (inclusive). The vulnerability was published on January 22, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium), as assessed by CISA-ADP (NVD, Patchstack).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate that state-changing requests originate from legitimate, authenticated user sessions. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or user, silently submits forged requests to the vulnerable plugin's endpoints. Exploitation requires user interaction (the victim must visit the attacker-controlled page) but no authentication or special privileges on the attacker's part (NVD, Patchstack).

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an authenticated user, primarily affecting the integrity of the WordPress site's SEO search settings or configurations managed by the WP SEO Search plugin. The confidentiality and availability impacts are assessed as none, meaning sensitive data exposure or service disruption are not direct consequences. The practical risk is limited to unauthorized modification of plugin settings, which could affect SEO-related functionality of the affected WordPress site (NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for CVE-2025-67626. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at approximately 0.008%, indicating a very low probability of exploitation in the near term (Feedly, NVD).

1. Reconnaissance: Identify a WordPress site running the WP SEO Search plugin (version ≤ 1.1), for example by checking the site's publicly accessible plugin directory or using tools like WPScan.
2. Identify target action: Determine which plugin administrative actions (e.g., saving settings) lack CSRF token validation by reviewing the plugin's source code or observing form submissions.
3. Craft malicious request: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged POST/GET request to the target WordPress site's vulnerable plugin endpoint with attacker-chosen parameters.
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page via phishing, a malicious link, or a compromised third-party site.
5. Action executed: The victim's browser automatically sends the forged request with their valid session cookies, causing the plugin to process the unauthorized action (e.g., modifying SEO settings) without the user's knowledge (NVD, Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to WP SEO Search plugin admin endpoints (e.g., wp-admin/admin-post.php or wp-admin/options.php) from unusual referrer URLs or external domains.
• Application: Unexplained changes to WP SEO Search plugin settings or configurations without corresponding administrator activity in the WordPress audit log.
• Network: Requests to WordPress admin endpoints originating from non-administrative IP addresses or with referrer headers pointing to external, unfamiliar domains.

WordPress site administrators should update the WP SEO Search plugin to a version beyond 1.1 if a patched release is available from the plugin author Angel Costa. If no patched version is available, the recommended workaround is to deactivate and remove the plugin until a fix is released. General hardening measures include enforcing strict referrer policies, using a Web Application Firewall (WAF) with CSRF protection rules, and ensuring only trusted administrators have access to plugin settings (Patchstack, NVD).