CVE-2025-8491 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Easy restaurant menu manager plugin for WordPress, developed by nikelschubert. This vulnerability exists in all versions up to and including 2.0.2 due to missing or incorrect nonce validation in the nsc_eprm_save_menu() function. Nonces in WordPress are security tokens used to verify that requests to perform actions originate from legitimate users and not from forged requests. The absence or improper implementation of nonce validation allows an attacker to craft a malicious request that, when executed by an authenticated site administrator (e.g., by clicking a link), can upload a menu file without their explicit consent. This attack vector requires user interaction but no prior authentication by the attacker. The vulnerability impacts the integrity of the website's data by allowing unauthorized modification of menu files, potentially leading to misinformation or malicious content being displayed. The CVSS v3.1 score is 4.3 (medium severity), reflecting the fact that the attack is network exploitable, requires low attack complexity, no privileges, but does require user interaction. There is no known exploit in the wild at the time of publication, and no patches have been released yet. The vulnerability is categorized under CWE-352, which is a common web security issue related to CSRF attacks. Given the plugin’s use case in managing restaurant menus, the attack surface is primarily WordPress sites running this plugin, which may be small to medium-sized hospitality businesses or restaurants using WordPress for their online presence.

For European organizations, especially those in the hospitality and restaurant sectors using WordPress with the Easy restaurant menu manager plugin, this vulnerability poses a risk to the integrity of their online content. An attacker could manipulate menu data, potentially causing reputational damage, customer confusion, or even indirect financial loss if malicious content or incorrect pricing is displayed. While the vulnerability does not directly compromise confidentiality or availability, the integrity impact could undermine trust in the affected websites. Additionally, if attackers upload malicious files disguised as menu files, there could be a risk of further exploitation or malware delivery, although this is not explicitly stated. Since many European restaurants rely on their websites for customer engagement and ordering, any disruption or misinformation could have tangible business impacts. The requirement for user interaction (an administrator clicking a malicious link) means that social engineering is a key component of exploitation, which is a common attack vector in Europe. The medium severity score suggests that while the threat is not critical, it should be addressed promptly to avoid potential misuse.

1. Immediate mitigation should include educating site administrators to be cautious about clicking on unsolicited links, especially those that could trigger administrative actions on their WordPress sites. 2. Implement manual nonce validation in the nsc_eprm_save_menu() function if possible, by modifying the plugin code to verify WordPress nonces correctly before processing menu uploads. 3. Restrict administrative actions to trusted networks or VPNs to reduce exposure to CSRF attacks. 4. Use Web Application Firewalls (WAFs) with rules that detect and block suspicious POST requests that do not include valid nonces or originate from untrusted sources. 5. Monitor website logs for unusual POST requests to the menu upload endpoint to detect potential exploitation attempts. 6. Regularly back up website data to enable quick restoration in case of unauthorized changes. 7. Follow up with the plugin vendor for official patches and apply them as soon as they become available. 8. Consider temporarily disabling the plugin or restricting its usage until a patch is released if the risk is deemed high.