CVE-2025-49291

Executive Summary

CVE-2025-49291 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Calculated Fields Form by Codepeople, affecting versions through 5.3.58. This flaw allows an attacker to forge requests on behalf of an authenticated administrator, potentially leading to unauthorized configuration changes or data manipulation within the form builder. The vulnerability is classified as medium severity (CVSS 4.3) and currently has no known public exploit or patch. As a WordPress ecosystem issue, it impacts sites using this plugin for dynamic form calculations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is limited to direct plugin installations on WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests active exploitation is unlikely, but the lack of a patch increases long-term risk.

Deep Dive & Mechanics

The vulnerability stems from the plugin’s failure to implement CSRF tokens or nonces in its administrative actions. An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a state-changing request (e.g., modifying form settings, deleting forms, or injecting malicious JavaScript). The request is executed with the victim’s session cookies, bypassing authentication.

Key affected endpoints likely include:

• Form creation/deletion actions
• Field configuration updates
• Plugin settings modifications

No authentication is required to initiate the attack, but the victim must be logged in as an administrator.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a hypothetical secure implementation.

Vulnerable Code (PHP):

// In admin-actions.php
function save_form_settings() {
    // No CSRF check
    update_option('cf_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=cf-forms'));
}

Patched Code (Hypothetical):

// In admin-actions.php
function save_form_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'cf_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('cf_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=cf-forms'));
}

The patch adds a nonce check using WordPress’s built-in wp_verify_nonce() function.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Calculated Fields Form <= 5.3.58 installed and activated.
• An authenticated admin session (victim).

Exploitation Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or send via email.
3. Lure the admin to visit the page while logged into WordPress.

Example Payload (HTML):

<html>
<body>
<form action="http://target/wp-admin/admin.php?page=cf-forms&action=delete&form_id=1" method="POST" id="csrf">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

This deletes form ID 1 without the admin’s consent.

Blue Team

Detection:

• Monitor for unexpected POST requests to /wp-admin/admin.php with parameters like page=cf-forms from external referrers.
• Alert on multiple form deletion or modification events within a short timeframe.

Hunting:

• Search logs for admin.php?page=cf-forms with action=delete or action=save originating from non-admin IPs.
• Use the Sigma rule below to detect CSRF attempts.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin.php with page=cf-forms and suspicious action parameters (e.g., delete, save).
• Host: Unexpected form deletions or modifications in the plugin’s database tables (wp_cf_forms, wp_cf_fields).
• Logs: WordPress debug logs showing wp_die() calls related to nonce failures (if patched).

Detection Engineering

YARA Rule

rule CVE_2025_49291_CSRF_CalculatedFieldsForm {
    meta:
        description = "Detects CSRF exploitation attempts against Calculated Fields Form plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49291"
    strings:
        $admin_page = "admin.php?page=cf-forms"
        $action_delete = "action=delete"
        $action_save = "action=save"
        $post_method = "POST"
    condition:
        all of ($admin_page, $post_method) and any of ($action_delete, $action_save)
}

Sigma Rule

title: CVE-2025-49291 - CSRF Against Calculated Fields Form
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting the Calculated Fields Form plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: 
            - "/wp-admin/admin.php"
            - "page=cf-forms"
            - "action=delete"
            - "action=save"
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49291 - CSRF Attempt Against Calculated Fields Form";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin.php";
    http.uri; content:"page=cf-forms";
    http.uri; content:"action=delete" or content:"action=save";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Codepeople.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin.php with page=cf-forms from external referrers.
3. Enforce CSRF tokens manually by adding a custom nonce check via a WordPress plugin like "Nonce Manager" or by editing the plugin’s code (if feasible).

Long-term:

• Monitor the plugin’s changelog for a patched version (> 5.3.58).
• Consider replacing the plugin with an alternative that supports CSRF protection natively.
• Educate administrators to avoid clicking suspicious links while logged into WordPress.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.