Overview
CVE-2025-13134 describes a Cross-Site Request Forgery (CSRF) vulnerability found in the AuthorSure plugin for WordPress. This vulnerability affects all versions of the plugin up to and including version 2.3. Due to missing or insufficient nonce validation, attackers can potentially trick administrators into performing unintended actions, such as updating plugin settings or injecting malicious scripts into the WordPress site.
Technical Details
The AuthorSure plugin versions 2.3 and below lack proper protection against CSRF attacks on the ‘authorsure’ page. Specifically, the plugin does not adequately validate nonces when processing requests to modify plugin settings. This allows an unauthenticated attacker to craft a malicious HTML page or URL. If a logged-in administrator visits this page or clicks the malicious link, the attacker can force the administrator’s browser to send a forged request to the WordPress server, effectively allowing the attacker to modify plugin settings as if they were the administrator. This can include injecting arbitrary JavaScript code, potentially leading to site defacement, data theft, or other malicious activities.
CVSS Analysis
The vulnerability has been assigned a CVSS score of 6.1, indicating a MEDIUM severity.
- CVSS Score: 6.1
- Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Explanation:
- AV:N (Attack Vector: Network): The vulnerability is exploitable over the network.
- AC:L (Attack Complexity: Low): Exploitation requires little to no special access or circumstances.
- PR:N (Privileges Required: None): No privileges are required to perform an attack.
- UI:R (User Interaction: Required): User interaction (e.g., clicking a link) is required for the attack to succeed.
- S:C (Scope: Changed): An exploited vulnerability can affect resources beyond the attacker’s control (e.g., a different security context).
- C:L (Confidentiality: Low): Limited information disclosure.
- I:L (Integrity: Low): Limited modification of data.
- A:N (Availability: None): No impact on system availability.
Possible Impact
Successful exploitation of this CSRF vulnerability could have several negative consequences:
- Settings Modification: An attacker could change the AuthorSure plugin settings to inject malicious code.
- Malicious Script Injection: By injecting malicious JavaScript code, an attacker could redirect users to phishing sites, steal user credentials, or deface the website.
- SEO Poisoning: Attackers could modify the plugin’s settings to inject SEO spam and harm the site’s search engine ranking.
- Account Takeover: In some scenarios, injected scripts could be used to compromise administrator accounts.
Mitigation and Patch Steps
To mitigate this vulnerability, it is highly recommended to take the following steps:
- Update the Plugin: The primary mitigation is to update the AuthorSure plugin to a version higher than 2.3. Check the WordPress plugin repository for the latest version.
- Disable the Plugin: If an update is not immediately available, consider temporarily disabling the AuthorSure plugin until a patched version is released.
- Be Cautious of Links: Always be cautious when clicking on links or visiting unfamiliar websites, especially when logged in as an administrator.
- Review User Activity: Monitor user activity on your WordPress site for any suspicious behavior.
