CVE-2025-0796: Wprequal CSRF Vulnerability in WordPress

CVE-2025-0796 Overview

CVE-2025-0796 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mortgage Lead Capture System (wprequal) plugin for WordPress, developed by kevinbrent. The flaw affects all versions up to and including 8.2.11 and stems from missing or incorrect nonce validation on the wprequal_reset_defaults action. Unauthenticated attackers can craft a malicious link or page that, when clicked by an authenticated administrator, resets the plugin's settings to their defaults. Exploitation requires user interaction but no privileges, making phishing and watering-hole delivery viable. The weakness is categorized under [CWE-352].

Critical Impact
An attacker can silently reset the Mortgage Lead Capture System plugin configuration by tricking an administrator into visiting a crafted link, disrupting lead capture workflows and site integrity.

Affected Products

Mortgage Lead Capture System (wprequal) WordPress plugin — all versions up to and including 8.2.11
Vendor: kevinbrent
Deployment surface: WordPress sites with the plugin installed and active

Discovery Timeline

2025-02-18 - CVE-2025-0796 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0796

Vulnerability Analysis

The Mortgage Lead Capture System plugin exposes an administrative action, wprequal_reset_defaults, that restores the plugin's configuration to its default state. WordPress provides a nonce mechanism to bind sensitive state-changing requests to a specific user session, but this handler does not correctly validate a nonce before executing the reset. As a result, any authenticated administrator's browser can be coerced into submitting the reset request through a forged HTTP request originating from an attacker-controlled page.

The impact is limited to integrity: plugin settings are overwritten with defaults. Confidentiality and availability of the underlying WordPress site are not directly affected, and the attacker cannot execute code or exfiltrate data through this flaw alone. However, resetting configuration can disrupt mortgage lead capture forms, downstream integrations, and email routing, which may cause loss of business data collected through the plugin.

Root Cause

The root cause is missing or improperly implemented CSRF token verification on the wprequal_reset_defaults action handler. Without a check_admin_referer() or wp_verify_nonce() check bound to a unique, per-session token, the plugin cannot distinguish between a legitimate administrator-initiated reset and a forged cross-origin request. This falls squarely within [CWE-352]: Cross-Site Request Forgery.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or image tag that issues a request to the target WordPress site's admin endpoint for the wprequal_reset_defaults action. The attacker then delivers the link to a site administrator through phishing email, forum posts, or social media. When the administrator, who has an active WordPress session, visits the page, the browser attaches session cookies to the forged request and the plugin executes the reset. No credentials or interaction with the WordPress admin interface itself are required beyond the initial click.

No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-0796

Indicators of Compromise

Unexpected reset of wprequal plugin settings to defaults without a corresponding administrator-initiated change in the audit trail.
HTTP POST or GET requests to admin-ajax.php or admin-post.php invoking the wprequal_reset_defaults action with a Referer header pointing to an external domain.
Web server access logs showing requests to the reset endpoint originating from cross-origin referrers or lacking a valid nonce parameter.

Detection Strategies

Monitor WordPress activity logs for wprequal setting changes and correlate them with administrator sessions and source IP addresses.
Alert on outbound clicks from administrator accounts to unfamiliar domains immediately preceding plugin configuration changes.
Deploy a Web Application Firewall (WAF) rule that inspects requests targeting the wprequal_reset_defaults action and blocks those missing a valid same-origin Referer or nonce.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record all administrative actions, including plugin configuration changes.
Forward WordPress and web server logs to a centralized SIEM or data lake for correlation across administrator activity and inbound HTTP requests.
Review administrator email and browsing telemetry for phishing links that could be used to deliver the CSRF payload.

How to Mitigate CVE-2025-0796

Immediate Actions Required

Update the Mortgage Lead Capture System plugin to a version later than 8.2.11 as soon as a patched release is published by the vendor.
Audit current plugin settings and back up the configuration so administrators can restore it quickly if a reset occurs.
Instruct administrators to log out of WordPress when not actively managing the site to reduce the window during which a forged request would succeed.

Patch Information

The vendor published a code change addressing the missing nonce validation, documented in the WordPress Plugin Change Log. Refer to the WordPress Plugin Information page for the latest release and to the Wordfence Vulnerability Report for additional advisory context.

Workarounds

Deactivate the wprequal plugin until a patched version is applied if the reset risk is unacceptable for the environment.
Restrict administrator access to the WordPress dashboard by IP allowlisting to reduce the effective attack surface for forged requests.
Enforce short administrator session lifetimes and require re-authentication for privileged actions.
Train administrators to avoid clicking untrusted links while logged into WordPress, and use a dedicated browser profile for administrative work.

bash

# Configuration example: restrict wp-admin to trusted IPs via .htaccess
<Files admin-ajax.php>
  Order Deny,Allow
  Deny from all
  Allow from 203.0.113.10
  Allow from 198.51.100.0/24
</Files>