CVE-2025-39601: WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP allows Remote Code Inclusion. This issue affects Custom CSS, JS & PHP: from n/a through 2.4.1.
Other sources
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39601?
CVE-2025-39601 is considered a critical Cross-Site Request Forgery (CSRF) vulnerability that allows Remote Code Inclusion.
How do I fix CVE-2025-39601?
To fix CVE-2025-39601, upgrade WPFactory Custom CSS, JS & PHP to version 2.4.2 or later.
Who is affected by CVE-2025-39601?
CVE-2025-39601 affects all versions of WPFactory Custom CSS, JS & PHP from n/a through 2.4.1.
What kind of attacks can occur due to CVE-2025-39601?
CVE-2025-39601 could potentially enable attackers to execute arbitrary code on the server through CSRF attacks.
Is there a workaround for CVE-2025-39601?
As a workaround for CVE-2025-39601, it is recommended to disable the plugin until it can be updated.