CVE-2025-67467

Executive Summary

CVE-2025-67467 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the GiveWP plugin for WordPress, developed by StellarWP. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions on the GiveWP donation management system. The vulnerability exists in all versions of GiveWP from n/a through 4.13.1. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The CVSS score is 5.4 (Medium), indicating a moderate risk primarily due to the requirement for user interaction (clicking a crafted link) and the potential for limited impact on confidentiality and integrity.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. GiveWP is a widely used donation and fundraising plugin. The CSRF flaw could be exploited to modify plugin settings, create fraudulent donation forms, or alter donor data without the administrator's consent. Since this is a WordPress plugin, the attack surface is limited to sites running the vulnerable plugin version. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for the attack.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The victim must click a malicious link or visit a crafted page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited disclosure of information is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the likelihood of automated exploitation, but the lack of a patch makes all GiveWP installations up to 4.13.1 vulnerable.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw in the GiveWP plugin. CSRF attacks exploit the trust a web application has in an authenticated user's browser. When an administrator is logged into WordPress, their browser automatically includes session cookies with every request to the site. An attacker can craft a malicious HTML page or email that, when viewed by the administrator, triggers a forged request to the GiveWP plugin's administrative endpoints.

The specific endpoint(s) vulnerable are not publicly documented, but typical CSRF targets in WordPress plugins include:

• Changing plugin settings (e.g., payment gateway configurations).
• Creating or deleting donation forms.
• Modifying donor records.
• Exporting sensitive data.

Because GiveWP handles financial transactions and donor information, a successful CSRF attack could lead to:

• Financial Fraud: Redirecting donations to an attacker-controlled account.
• Data Theft: Exporting donor personal information (PII).
• Reputation Damage: Defacing donation forms or injecting malicious content.

The vulnerability is present because the plugin does not implement proper CSRF tokens (nonces) on its administrative actions. WordPress provides a built-in nonce system, but the plugin fails to validate it on critical operations.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be made. However, the fix would involve adding WordPress nonce verification to all administrative actions.

Vulnerable Code (Conceptual):

// In a GiveWP admin handler (e.g., save_settings.php)
function givewp_save_settings() {
    // No nonce check
    update_option('givewp_payment_gateway', $_POST['gateway']);
    // ... other actions
}

Patched Code (Expected Fix):

function givewp_save_settings() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'givewp_save_settings')) {
        wp_die('Security check failed.');
    }
    update_option('givewp_payment_gateway', $_POST['gateway']);
    // ... other actions
}

The patched version would include wp_verify_nonce() checks on all admin POST requests, ensuring the request originated from the legitimate admin interface.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site running GiveWP <= 4.13.1.
• An authenticated administrator session.
• A way to deliver the malicious payload (e.g., email, forum post, or compromised site).

Exploitation Steps:

1. Craft the Malicious HTML Page: Create an HTML file that automatically submits a form to the vulnerable GiveWP endpoint. For example, to change the payment gateway to a test mode:

   <html>
   <body>
   <h1>Click here for a free gift!</h1>
   <form id="csrf_form" action="http://target-site.com/wp-admin/admin-post.php?action=givewp_save_settings" method="POST">
       <input type="hidden" name="gateway" value="attacker_gateway">
       <input type="hidden" name="test_mode" value="1">
   </form>
   <script>
       document.getElementById('csrf_form').submit();
   </script>
   </body>
   </html>
   

2. Deliver the Payload: Host the HTML file on an attacker-controlled server or embed it in an email. Send it to the target administrator.

3. Trigger the Attack: When the administrator visits the page (or the email is rendered), the form auto-submits, changing the GiveWP settings without their knowledge.

Expected Outcome:

• The payment gateway is switched to a test mode or an attacker-controlled gateway.
• Future donations are redirected or logged insecurely.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor Admin Actions: Log all POST requests to admin-post.php and admin-ajax.php that modify GiveWP settings. Look for requests without a valid nonce parameter.
2. User Behavior Analytics: Flag unusual patterns, such as an administrator changing payment settings immediately after clicking a link from an external source.
3. Web Application Firewall (WAF): Deploy rules to block requests to GiveWP admin endpoints that lack a valid _wpnonce parameter.

Prevention:

• Immediate: Disable the GiveWP plugin until a patch is available, or restrict access to its admin pages via IP whitelisting.
• Long-term: Implement a Content Security Policy (CSP) that restricts form submissions to trusted origins. Use WordPress's built-in nonce system for all admin actions.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-post.php with action=givewp_* parameters and no _wpnonce field.
  • Referer headers from external domains (e.g., attacker-controlled sites) when accessing GiveWP admin pages.
• Host:
  • Unexpected changes to GiveWP settings in the database (e.g., givewp_settings option).
  • New donation forms or modified donor records without corresponding admin activity logs.
• Logs:
  • WordPress debug log entries showing failed nonce checks (if custom logging is enabled).
  • Web server access logs showing POST requests to GiveWP admin endpoints from unusual IPs.

Detection Engineering

YARA Rule

rule Detect_GiveWP_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against GiveWP plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67467"
    strings:
        $csrf_form = /<form[^>]*action=["'][^"']*admin-post\.php[^"']*["'][^>]*>/ nocase
        $givewp_action = /action=givewp_/ nocase
        $no_nonce = /<input[^>]*name=["']_wpnonce["']/ nocase
    condition:
        $csrf_form and $givewp_action and not $no_nonce
}

Sigma Rule

title: GiveWP CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting GiveWP admin endpoints without a nonce parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=givewp_'
        cs-uri-stem|endswith: '/admin-post.php'
    filter:
        cs-uri-query|contains: '_wpnonce='
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce (should be filtered)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67467 GiveWP CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=givewp_";
    http_uri;
    pcre:"/^((?!_wpnonce).)*$/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin if it is not critical to operations.
2. Restrict admin access to the GiveWP settings pages via IP whitelisting or .htaccess rules.
3. Monitor for suspicious activity using the IOCs and detection rules above.

Long-term Fix:

• Apply the official patch once released by StellarWP.
• If patching is delayed, implement a custom WordPress plugin that adds nonce verification to all GiveWP admin actions (e.g., using the admin_post_ hook).

Workaround:

• Use a Web Application Firewall (WAF) to block requests to admin-post.php that do not include a valid _wpnonce parameter.

Valters IT