CVE-2025-11497 Overview
CVE-2025-11497 is a Cross-Site Request Forgery (CSRF) vulnerability in the Advanced Database Cleaner plugin for WordPress. The flaw affects all versions up to and including 3.1.6. It stems from missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. Unauthenticated attackers can alter the plugin's keep last setting by tricking a site administrator into clicking a crafted link. The issue is tracked under [CWE-20] Improper Input Validation. CVE-2025-64357 is a duplicate of this issue.
Critical Impact
Unauthenticated attackers can modify plugin cleanup settings through forged requests when an administrator is socially engineered into clicking a malicious link, potentially leading to unintended database record deletion.
Affected Products
- Advanced Database Cleaner plugin for WordPress, all versions up to and including 3.1.6
- WordPress sites with the vulnerable plugin installed and active
- Administrator sessions on affected WordPress installations
Discovery Timeline
- 2025-10-25 - CVE-2025-11497 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11497
Vulnerability Analysis
The Advanced Database Cleaner plugin exposes an administrative action that lacks proper anti-CSRF protection. The aDBc_prepare_elements_to_clean() function processes state-changing requests without verifying a valid WordPress nonce. Without nonce validation, the plugin cannot distinguish between legitimate administrator-initiated requests and requests forged by a third-party site. An attacker who lures an authenticated administrator to a malicious page can cause that administrator's browser to submit a request that changes the plugin's keep last configuration value. The impact is limited to integrity of the plugin's configuration, with no direct confidentiality or availability impact per the CVSS vector, and user interaction is required.
Root Cause
The root cause is missing or incorrect nonce validation on a privileged plugin handler. WordPress provides wp_nonce_field() and check_admin_referer() primitives to prevent CSRF, but the aDBc_prepare_elements_to_clean() function does not correctly verify these tokens before performing configuration changes. This maps to [CWE-20] Improper Input Validation.
Attack Vector
The attack requires an authenticated administrator to visit an attacker-controlled page while logged into WordPress. The malicious page triggers a cross-origin request, such as an auto-submitting form or image tag, targeting the vulnerable plugin endpoint. Because the administrator's session cookie is transmitted automatically and no nonce is verified, the plugin accepts the request and updates the keep last setting. No credentials or prior authentication are required on the attacker's side.
No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details.
Detection Methods for CVE-2025-11497
Indicators of Compromise
- Unexpected changes to Advanced Database Cleaner plugin settings, particularly the keep last value, without a corresponding administrator action in audit logs.
- HTTP POST or GET requests to plugin admin endpoints containing an external Referer header pointing to untrusted domains.
- Administrator browser sessions submitting requests to wp-admin shortly after visiting third-party sites.
Detection Strategies
- Review web server access logs for requests to Advanced Database Cleaner admin pages with off-site Referer headers.
- Monitor WordPress activity logs for configuration changes to the plugin that lack a matching administrator UI interaction.
- Compare plugin option values in the wp_options table against expected baselines to identify unauthorized modifications.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record all plugin configuration changes with source IP and user context.
- Alert on outbound-originating requests to wp-admin endpoints that lack a valid same-origin Referer.
- Track plugin version inventory across WordPress installations to confirm all instances are patched above 3.1.6.
How to Mitigate CVE-2025-11497
Immediate Actions Required
- Update Advanced Database Cleaner to a version later than 3.1.6 as soon as the vendor releases a patched release.
- Restrict administrator browsing habits and require dedicated browser profiles or sessions for WordPress administration.
- Audit recent plugin setting changes and restore the keep last value to the intended configuration.
Patch Information
The vendor addressed the issue in a plugin update tracked in the WordPress Plugin Changeset. Administrators should upgrade to the fixed version referenced in the Wordfence Vulnerability Report.
Workarounds
- Deactivate the Advanced Database Cleaner plugin until the patched version is deployed.
- Deploy a web application firewall rule that requires a valid same-origin Referer and known WordPress nonce parameter on plugin admin requests.
- Instruct administrators to log out of WordPress sessions before browsing untrusted sites, reducing CSRF exposure.
# Configuration example: verify installed plugin version via WP-CLI
wp plugin get advanced-database-cleaner --field=version
wp plugin update advanced-database-cleaner
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
