CVE-2025-0808 Overview
The Houzez Property Feed plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.4.21. The flaw stems from missing or incorrect nonce validation on the deleteexport action. Unauthenticated attackers can delete property feed exports by tricking a site administrator into clicking a crafted link or visiting a malicious page. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Unauthenticated attackers can delete property feed exports on affected WordPress sites when an administrator interacts with a forged request, causing loss of feed data integrity.
Affected Products
- Wp-property-hive Houzez Property Feed plugin for WordPress
- All versions up to and including 2.4.21
- WordPress sites using the houzez_property_feed component
Discovery Timeline
- 2025-02-12 - CVE-2025-0808 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0808
Vulnerability Analysis
The vulnerability resides in the plugin's export management functionality, specifically the deleteexport action handler in class-houzez-property-feed-export.php. The handler processes deletion requests without verifying a valid WordPress nonce token. This omission allows any external site to submit a state-changing request on behalf of an authenticated administrator.
CSRF vulnerabilities exploit the trust a web application places in an authenticated user's browser session. When an administrator visits an attacker-controlled page while logged into WordPress, the browser automatically attaches authentication cookies to any outbound request. Without nonce validation, the plugin cannot distinguish between a legitimate administrative action and a forged one.
Successful exploitation results in the deletion of property feed exports. The requires user interaction, meaning the attacker must first lure an administrator into clicking a malicious link or loading a page that automatically issues the request. The EPSS score of 0.158% indicates a low predicted probability of exploitation in the near term.
Root Cause
The root cause is the absence of a proper WordPress nonce check on the deleteexport action. WordPress provides wp_verify_nonce() and check_admin_referer() functions specifically to prevent CSRF. The affected handler either omitted these checks entirely or implemented them incorrectly, leaving the destructive action reachable via forged requests.
Attack Vector
The attack vector is network-based with required user interaction. An attacker crafts an HTML page or link that triggers a request to the deleteexport endpoint on the target WordPress site. The attacker distributes this content via phishing email, social media, or a compromised website. When a logged-in administrator interacts with the malicious content, the browser submits the request with valid session cookies, and the plugin executes the deletion.
See the Wordfence Vulnerability Report for additional technical context on the CSRF flow.
Detection Methods for CVE-2025-0808
Indicators of Compromise
- Unexpected deletion of property feed export records in the Houzez Property Feed plugin
- HTTP POST or GET requests to the deleteexport action originating from external Referer headers
- Administrator sessions coinciding with requests to unfamiliar third-party domains immediately before feed data loss
- Absence of a valid WordPress nonce parameter (_wpnonce) on deleteexport requests in web server logs
Detection Strategies
- Review WordPress and web server access logs for deleteexport action requests and correlate them with the Referer header to identify off-site origins
- Enable WordPress audit logging plugins to record administrative actions and detect unauthorized deletion events
- Monitor plugin file integrity for the class-houzez-property-feed-export.php file to confirm patched code is deployed
Monitoring Recommendations
- Track administrator activity for anomalous deletion patterns on property feed exports
- Alert on inbound requests to admin.php or admin-ajax.php containing the deleteexport action without a valid nonce parameter
- Correlate administrator authentication events with subsequent state-changing requests to identify potential CSRF exploitation attempts
How to Mitigate CVE-2025-0808
Immediate Actions Required
- Update the Houzez Property Feed plugin to a version later than 2.4.21 that includes the nonce validation fix
- Audit existing property feed exports and restore any missing data from backups
- Instruct administrators to log out of WordPress before browsing unrelated sites and to avoid clicking untrusted links while authenticated
Patch Information
The vendor addressed the issue in the plugin source, as documented in the WordPress Plugin Change Log. The changeset adds nonce validation to the deleteexport action handler, ensuring that requests without a valid _wpnonce token are rejected.
Workarounds
- Restrict WordPress administrator access using IP allowlists at the web server or WAF layer to reduce CSRF exposure
- Deploy a web application firewall rule to block deleteexport requests that lack the _wpnonce parameter
- Temporarily deactivate the Houzez Property Feed plugin until patching is complete if the affected functionality is not in active use
# Example WAF rule concept to block deleteexport requests missing a nonce
# (adapt to your WAF syntax)
SecRule ARGS:action "@streq deleteexport" \
"chain,deny,status:403,id:1000808,msg:'Block CSRF on Houzez deleteexport'"
SecRule &ARGS:_wpnonce "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
