CVE-2025-13892

Executive Summary

CVE-2025-13892 is a reflected Cross-Site Scripting (XSS) vulnerability in the MG AdvancedOptions WordPress plugin, affecting all versions up to and including 1.2. The flaw resides in the plugin’s improper handling of the $_SERVER['PHP_SELF'] variable, which is used to construct dynamic URLs or form actions. An unauthenticated attacker can inject arbitrary JavaScript into the PHP_SELF value, which is then reflected back to the victim’s browser without proper sanitization or output escaping. Successful exploitation requires user interaction (e.g., clicking a crafted link), but no authentication is needed. The CVSS score is 6.1 (Medium), with low impact on confidentiality and integrity. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a malicious link or submit a crafted form.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session hijacking).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. No active exploitation has been reported, and the EPSS score is 0.0%.

Deep Dive & Mechanics

The vulnerability exists because the plugin uses $_SERVER['PHP_SELF'] to generate self-referencing URLs or form actions without proper sanitization. In PHP, $_SERVER['PHP_SELF'] contains the current script name and can be manipulated by appending a path or query string to the URL. For example, an attacker can craft a URL like:

http://target.com/wp-content/plugins/mg-advancedoptions/some-file.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E

The %22%3E%3Cscript%3E decodes to "><script>, which breaks out of an HTML attribute context. If the plugin echoes this value without escaping, the injected script executes in the victim’s browser.

The root cause is insufficient input sanitization and output escaping. The plugin likely uses echo $_SERVER['PHP_SELF'] or similar without applying htmlspecialchars() or esc_url().

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2):

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    <!-- form fields -->
</form>

Patched Code (hypothetical fix):

<form action="<?php echo esc_url( $_SERVER['REQUEST_URI'] ); ?>" method="post">
    <!-- form fields -->
</form>

Or, using admin_url() or plugin_dir_url() to generate safe URLs.

The fix must ensure that any user-controllable input used in HTML attributes is properly escaped with esc_url() or esc_attr(), and that $_SERVER['PHP_SELF'] is not used directly.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with the MG AdvancedOptions plugin version 1.2 on a local or cloud lab.
2. Craft Payload: Create a malicious URL that injects JavaScript via PHP_SELF:

   http://lab.local/wp-content/plugins/mg-advancedoptions/options.php/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
   

3. Deliver: Send the link to a victim via email, social engineering, or a phishing campaign.
4. Execute: When the victim clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for abnormal URL patterns containing encoded HTML tags or script keywords in the path.
2. WAF Rules: Deploy a Web Application Firewall rule to block requests with PHP_SELF manipulation:

   SecRule REQUEST_URI "@rx %22|%3E|%3C" "id:1001,phase:1,deny,status:403,msg:'XSS via PHP_SELF'"
   

3. Harden Plugin: If patching is not possible, disable the plugin or replace it with an alternative.
4. User Training: Educate users not to click suspicious links, especially those containing encoded characters.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing %22, %3E, %3C, or script in the path after /wp-content/plugins/mg-advancedoptions/.
• Log Entries: HTTP 200 responses to URLs with encoded HTML tags in the PHP_SELF portion.
• Client-Side: Unexpected JavaScript execution, pop-ups, or redirections on WordPress admin pages.
• Network: Outbound connections to attacker-controlled domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2025_13892_XSS_PHP_SELF {
    meta:
        description = "Detects attempts to exploit CVE-2025-13892 via PHP_SELF injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13892"
    strings:
        $php_self = "PHP_SELF"
        $xss_payload = /%22|%3E|%3C|script|alert|onerror/
    condition:
        $php_self and $xss_payload
}

Sigma Rule

title: CVE-2025-13892 Reflected XSS via PHP_SELF
id: 8a3f7c2e-5b1d-4f9a-8c6e-2d1a3b4c5e6f
status: experimental
description: Detects HTTP requests attempting to exploit reflected XSS in MG AdvancedOptions plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '%22'
            - '%3E'
            - '%3C'
            - 'script'
            - 'alert'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in URLs (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-13892 - Reflected XSS via PHP_SELF in MG AdvancedOptions";
    flow:to_server,established;
    content:"/wp-content/plugins/mg-advancedoptions/"; http_uri;
    pcre:"/(%22|%3E|%3C|script|alert)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the MG AdvancedOptions plugin until a patch is available.
2. Patch: Apply the vendor’s fix when released. If no patch is forthcoming, consider forking the plugin and fixing the code yourself.
3. Workaround: Use a Web Application Firewall (WAF) to block malicious requests containing encoded HTML tags in the URL path.
4. Code Fix: Replace all instances of $_SERVER['PHP_SELF'] with esc_url( $_SERVER['REQUEST_URI'] ) or use WordPress functions like admin_url().
5. Monitoring: Enable detailed logging for WordPress and web server logs to detect exploitation attempts.
6. User Awareness: Train users to recognize phishing links and avoid clicking suspicious URLs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst