What the vulnerability does
01Description
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Custom Twitter Feeds plugin versions up to 2.2.5 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the plugin's settings or configuration. The vulnerability requires user interaction and does not expose sensitive data, but can result in unauthorized changes to the plugin's behavior.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into visiting a malicious page that changes the plugin's settings without their knowledge.
Potential impact on your site
04Site Impact
Plugin settings could be altered by an attacker without your consent, potentially affecting how tweets are displayed on your site.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit an attacker-controlled page or click a malicious link.
Key dates
06Disclosure timeline
March 20, 2025
CVE published
April 8, 2026
Record updated
