CVE-2025-0990 Overview
CVE-2025-0990 is a Cross-Site Request Forgery (CSRF) vulnerability in the I Am Gloria plugin for WordPress. The flaw exists in all versions up to and including 1.1.4. The iamgloria23_gloria_settings_page function lacks proper nonce validation, allowing forged requests to reset the plugin tenant ID. Exploitation requires an unauthenticated attacker to trick a site administrator into clicking a crafted link. The issue is categorized under CWE-352.
Critical Impact
Successful exploitation allows attackers to reset the tenant ID configuration of the I Am Gloria plugin, disrupting the AI assistant integration on affected WordPress sites.
Affected Products
- I Am Gloria (Gloria Assistant by Webtronic Labs) WordPress plugin versions up to and including 1.1.4
- WordPress sites with the plugin installed and active
- Site administrators susceptible to social engineering via links or embedded content
Discovery Timeline
- 2025-03-05 - CVE-2025-0990 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0990
Vulnerability Analysis
The vulnerability stems from missing or incorrect nonce validation in the iamgloria23_gloria_settings_page function of the I Am Gloria plugin. WordPress relies on nonces as anti-CSRF tokens for state-changing administrative actions. When these tokens are absent or improperly verified, the site cannot confirm that a settings-change request originated from an authenticated administrative session.
An attacker exploits this by crafting a malicious webpage or link containing a request to the plugin settings endpoint. If an authenticated administrator visits the attacker-controlled resource, the browser submits the forged request using the administrator's active session. The plugin processes the request and resets the tenant ID.
Root Cause
The root cause is the absence of wp_verify_nonce() or equivalent CSRF token validation in the settings page handler. Without a request-origin check, WordPress accepts any authenticated request that reaches the endpoint, regardless of the referrer or intent.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker delivers a phishing link, embeds an image tag, or hosts an autosubmitting form on a page an administrator visits. When the administrator triggers the request, the plugin resets the configured tenant ID, disrupting the AI assistant integration and potentially redirecting service configuration.
No verified exploit code has been published. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-0990
Indicators of Compromise
- Unexpected changes to the I Am Gloria plugin tenant ID configuration in the WordPress admin settings
- WordPress access logs showing POST requests to the plugin settings endpoint originating from external Referer headers
- Administrator sessions accessing plugin settings shortly after clicking external links or opening emails
Detection Strategies
- Monitor WordPress wp_options table changes for I Am Gloria plugin configuration keys
- Review web server access logs for requests to plugin admin endpoints with unusual referrers or missing nonce parameters
- Correlate administrator browsing activity with plugin configuration modifications to identify suspicious sequences
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all administrative configuration changes
- Alert on plugin settings modifications outside of scheduled maintenance windows
- Track administrator authentication sessions and cross-reference with configuration change events
How to Mitigate CVE-2025-0990
Immediate Actions Required
- Update the I Am Gloria plugin to a version later than 1.1.4 once a patched release is available from the vendor
- Verify the current tenant ID configuration matches the intended value and restore it if tampering is suspected
- Restrict WordPress administrator accounts to trusted personnel and enforce strong authentication
Patch Information
At the time of publication, review the WordPress Plugin Page for the latest release addressing this issue. Consult the Wordfence Vulnerability Report for remediation guidance and fixed version information.
Workarounds
- Deactivate the I Am Gloria plugin until a patched version is installed
- Instruct administrators to log out of WordPress before browsing untrusted sites or clicking external links
- Deploy a Web Application Firewall (WAF) with rules that enforce Referer header validation on WordPress admin endpoints
- Use browser session isolation for WordPress administrative activity to reduce CSRF exposure
# Example: disable the plugin via WP-CLI until a patched version is released
wp plugin deactivate gloria-assistant-by-webtronic-labs
# Verify deactivation status
wp plugin status gloria-assistant-by-webtronic-labs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
