Cross-Site Request Forgery

CVE-2025-22301 is a CSRF flaw in the WordPress MyBookTable Bookstore plugin affecting versions through 3.5.3 and fixed in 3.5.4. Wordfence attributes it to missing or incorrect nonce validation in mbt_add_admin_notices(), which lets an unauthenticated attacker trick a logged-in administrator into making an unwanted state-changing request that can add the plugin's pages.

The vendor's MEDIUM 5.4 score is technically defensible in a vacuum, but it overstates operational urgency for enterprise patch queues. This is not unauthenticated RCE, not auth bypass, not data theft, and not broadly wormable; it needs the plugin to be installed, a privileged WordPress admin session, and a successful lure. That combination sharply narrows both reachable population and reliable exploitation, so this lands as LOW in the real world.

Why this verdict

• Admin session required: despite PR:N in CVSS, the exploit only lands if a privileged authenticated WordPress user performs the request, which is strong real-world friction.
• User interaction is mandatory: the chain needs a successful lure. That is a separate stage modern controls like SEG, browser isolation, and user awareness can disrupt.
• Blast radius is narrow: public descriptions point to adding plugin pages, not code execution, credential theft, database readout, or full site takeover.
• Small reachable population: this is a niche WordPress plugin with a modest install base, not a ubiquitous enterprise platform.
• No exploitation pressure: no KEV listing, no public active-campaign reporting, and an EPSS of 0.0009 all push urgency down.

Why not higher?

This is not an unauthenticated one-shot compromise. The attacker must first find a site with this plugin, then reach an authenticated administrator, then win user interaction, and even then the public record only supports limited page-creation impact. That is too much chain friction for MEDIUM/HIGH operational urgency in an enterprise patch queue.

Why not lower?

It still performs an unauthorized state-changing action in administrator context, so dismissing it entirely would be sloppy. In environments that host public author sites or where admins browse mail and the web from the same browser session, CSRF can still produce real changes and deserves cleanup during routine maintenance.

1. Separate admin browsing from email/web surfing — Keep WordPress admin work in a dedicated browser profile or isolated admin workstation so opportunistic CSRF lures have fewer chances to inherit an authenticated session. For a LOW verdict there is no SLA; treat this as backlog hygiene and implement during the next normal hardening cycle.
2. Restrict /wp-admin/ exposure — Put WordPress admin behind VPN, reverse-proxy ACLs, IP allowlists, or identity-aware access where feasible. This does not fix CSRF directly, but it reduces the number of admins who can be targeted from random internet browsing contexts. For a LOW verdict there is no SLA; align this with standard admin-surface reduction work.
3. Enable WordPress admin activity logging — Capture page creation, plugin configuration changes, and admin actions so forged requests leave an audit trail. This helps you spot abuse that perimeter scanners miss. For a LOW verdict there is no SLA; add it as routine CMS control improvement.
4. Inventory and update the plugin — Use WP-CLI, filesystem inventory, or CMS management tooling to find mybooktable and move any remaining installs to 3.5.4+. For a LOW verdict there is no SLA; bundle it into the next scheduled WordPress/plugin maintenance window.

Run this on the target WordPress host or inside the container/VM that serves the site. Invoke it as bash check-cve-2025-22301.sh /var/www/html where the argument is the WordPress root; it needs only read access to the plugin files, though wp-cli detection works best if the web user can read the install.

#!/usr/bin/env bash
# check-cve-2025-22301.sh
# Determine whether WordPress plugin mybooktable is vulnerable to CVE-2025-22301
# Affected: <= 3.5.3
# Fixed:    >= 3.5.4
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"
PLUGIN_SLUG="mybooktable"
FIXED_VERSION="3.5.4"

if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress/root"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path does not exist: $TARGET"
  exit 2
fi

PLUGIN_DIR="$TARGET/wp-content/plugins/$PLUGIN_SLUG"
MAIN_FILE="$PLUGIN_DIR/mybooktable.php"
README_FILE="$PLUGIN_DIR/readme.txt"
VERSION=""

verlte() {
  # returns 0 if $1 <= $2
  [[ "$1" == "$2" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$first" == "$1" ]]
}

# Prefer WP-CLI when available
if command -v wp >/dev/null 2>&1; then
  if wp --path="$TARGET" plugin is-installed "$PLUGIN_SLUG" >/dev/null 2>&1; then
    VERSION=$(wp --path="$TARGET" plugin get "$PLUGIN_SLUG" --field=version 2>/dev/null || true)
  fi
fi

# Fallback: parse main plugin header
if [[ -z "$VERSION" && -f "$MAIN_FILE" ]]; then
  VERSION=$(grep -iE '^\s*Version:\s*' "$MAIN_FILE" | head -n1 | sed -E 's/^\s*Version:\s*//I' | tr -d '\r' | xargs)
fi

# Fallback: parse readme stable tag
if [[ -z "$VERSION" && -f "$README_FILE" ]]; then
  VERSION=$(grep -iE '^\s*Stable tag:\s*' "$README_FILE" | head -n1 | sed -E 's/^\s*Stable tag:\s*//I' | tr -d '\r' | xargs)
fi

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - plugin '$PLUGIN_SLUG' not installed under $TARGET"
  exit 2
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - plugin installed but version could not be determined"
  exit 2
fi

if verlte "$VERSION" "3.5.3"; then
  echo "VULNERABLE - mybooktable version $VERSION is <= 3.5.3"
  exit 1
fi

if verlte "$FIXED_VERSION" "$VERSION"; then
  echo "PATCHED - mybooktable version $VERSION is >= 3.5.4"
  exit 0
fi

# Defensive catch-all for odd version formats
echo "UNKNOWN - unhandled version string: $VERSION"
exit 2

Sources

1. NVD CVE-2025-22301
2. Patchstack advisory for MyBookTable <= 3.5.3 CSRF
3. Wordfence record with vulnerable function details
4. WPScan plugin vulnerability page
5. WordPress.org MyBookTable plugin page
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. FIRST API documentation for EPSS queries