CVE-2025-10376 Overview
CVE-2025-10376 affects the Course Redirects for Learndash plugin for WordPress in all versions up to and including 0.4. The plugin fails to validate nonces when processing form submissions on its settings page. Unauthenticated attackers can craft forged requests that modify plugin settings when a site administrator is tricked into clicking a malicious link. The flaw is classified as Cross-Site Request Forgery [CWE-352] and stems from missing anti-CSRF token validation in redirect_course.php. Successful exploitation requires user interaction, limiting the attack to social engineering scenarios that target authenticated administrators.
Critical Impact
An attacker can silently alter Course Redirects for Learndash plugin settings when a logged-in administrator visits an attacker-controlled page, enabling unauthorized redirection of LearnDash course URLs.
Affected Products
- Course Redirects for Learndash WordPress plugin — all versions ≤ 0.4
- WordPress installations running the LearnDash learning management system with this plugin enabled
- Any site administrator session used to access the plugin settings page
Discovery Timeline
- 2025-10-11 - CVE-2025-10376 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10376
Vulnerability Analysis
The Course Redirects for Learndash plugin exposes a settings page that processes POST submissions without verifying the origin of the request. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to defend against Cross-Site Request Forgery, but the plugin does not implement them on its settings form. As a result, the form handler in redirect_course.php accepts any authenticated POST request regardless of its source.
An attacker who lures an authenticated administrator to a page under their control can auto-submit a form that targets the vulnerable endpoint. The administrator's browser attaches valid session cookies, and the plugin persists the attacker-supplied redirect configuration. The vulnerability affects data integrity by modifying course redirect targets. Confidentiality and availability are not directly impacted.
Root Cause
The root cause is missing nonce validation on the settings form handler. The plugin trusts any POST request that reaches the settings page while an administrator is logged in, violating the same-origin protections that WordPress recommends for privileged actions.
Attack Vector
Exploitation occurs over the network with low complexity and requires user interaction. The attacker hosts a page containing a hidden form or JavaScript payload that submits a crafted POST request to the target WordPress site's plugin settings endpoint. When an administrator with an active session visits the page, the browser submits the request and the plugin applies the malicious settings. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the vulnerable code path.
// No verified exploit code available.
// The vulnerability is triggered by a forged HTML form that POSTs
// to the plugin settings endpoint while an administrator session is active.
// Refer to the linked references for the exact vulnerable code path.
Detection Methods for CVE-2025-10376
Indicators of Compromise
- Unexpected changes to Course Redirects for Learndash plugin settings, particularly redirect targets pointing to external domains
- POST requests to the plugin settings page with Referer headers originating from domains other than the WordPress admin interface
- Administrator sessions submitting settings updates immediately after visiting external links or email attachments
Detection Strategies
- Inspect web server access logs for POST requests to the Course Redirects for Learndash settings endpoint that lack a same-origin Referer header
- Enable WordPress audit logging to capture plugin option changes and correlate them with administrator browsing activity
- Deploy a web application firewall rule that flags state-changing POST requests to wp-admin pages without a valid _wpnonce parameter
Monitoring Recommendations
- Alert on modifications to wp_options entries associated with the plugin outside of scheduled maintenance windows
- Monitor administrator accounts for anomalous outbound navigation followed by settings changes
- Review LearnDash course URL redirects on a recurring basis to identify unauthorized destinations
How to Mitigate CVE-2025-10376
Immediate Actions Required
- Deactivate the Course Redirects for Learndash plugin until a patched version is released by the maintainer
- Restrict administrator access to the WordPress dashboard from trusted networks or through VPN and multi-factor authentication
- Audit existing course redirect configurations and revert any entries that were not authorized
Patch Information
No fixed version has been published at the time of the NVD entry. All versions up to and including 0.4 remain affected. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for updates that add nonce validation to the settings handler.
Workarounds
- Remove or disable the plugin and manage LearnDash course redirects through server-level rewrites until a patched release is available
- Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin console
- Use a web application firewall to block cross-origin POST requests targeting the plugin settings endpoint
# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate course-redirects-for-learndash
wp plugin status course-redirects-for-learndash
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
