CVE-2025-12028: IndieAuth WordPress Plugin CSRF Vulnerability

CVE-2025-12028 Overview

The IndieAuth plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 4.5.4. This vulnerability stems from missing nonce verification on the login_form_indieauth() function and the authorization endpoint at wp-login.php?action=indieauth. Exploitation allows unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications through forged requests, potentially leading to complete account takeover with create, update, and delete permissions.

Critical Impact

Attackers can steal authorization codes and exchange them for access tokens, effectively taking over victim accounts with full create, update, and delete scopes when users click malicious links while logged in.

Affected Products

• IndieAuth WordPress Plugin versions up to and including 4.5.4
• WordPress sites with IndieAuth plugin installed
• OAuth authorization endpoints using IndieAuth

Discovery Timeline

• 2025-10-24 - CVE CVE-2025-12028 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12028

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core security flaw exists in the IndieAuth authorization endpoint implementation, specifically within the class-indieauth-authorization-endpoint.php file. The login_form_indieauth() function processes OAuth authorization requests without properly validating that the request originated from a legitimate user action through nonce verification.

When an authenticated WordPress user visits a malicious page crafted by an attacker, the page can silently submit a forged authorization request to the IndieAuth endpoint. Since no nonce token is checked, the server cannot distinguish between a legitimate user-initiated authorization and a forged cross-site request. The attacker's application receives an authorization code that can be exchanged for an access token with the victim's permissions.

Root Cause

The vulnerability originates from the absence of WordPress nonce verification in the login_form_indieauth() function and related authorization endpoint handlers. WordPress provides built-in CSRF protection through nonce tokens (wp_nonce_field() and wp_verify_nonce()), but these security mechanisms were not implemented in the affected code paths at lines 411, 418, and 476 of class-indieauth-authorization-endpoint.php.

Without nonce verification, the application cannot validate the authenticity and intent of incoming authorization requests, making it susceptible to forged cross-site requests that appear to come from legitimate authenticated sessions.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious webpage containing a hidden form or JavaScript that automatically submits an OAuth authorization request to the victim's WordPress site. The request specifies the attacker's application as the OAuth client requesting access.

When an authenticated WordPress administrator or user visits the attacker's page, the forged request executes in the context of their authenticated session. The IndieAuth endpoint processes the request as legitimate, generates an authorization code, and redirects to the attacker's callback URL. The attacker then exchanges this code for an access token, gaining the ability to create, update, and delete content on the victim's WordPress site.

Detection Methods for CVE-2025-12028

Indicators of Compromise

• Unexpected OAuth authorization grants appearing in WordPress IndieAuth logs
• Authorization codes being issued to unrecognized or suspicious application client IDs
• Access tokens associated with external IP addresses or unusual geographic locations
• Unexplained content modifications (posts, pages, or settings changes) on WordPress sites

Detection Strategies

• Monitor wp-login.php?action=indieauth endpoint access logs for requests originating from suspicious referrers or missing expected headers
• Audit IndieAuth plugin logs for authorization requests that lack corresponding user-initiated actions in session logs
• Implement Web Application Firewall (WAF) rules to detect and alert on cross-origin authorization requests
• Review OAuth token issuance events and correlate with user activity to identify unauthorized grants

Monitoring Recommendations

• Enable detailed logging for all IndieAuth authorization and token exchange events
• Configure alerting for authorization codes issued to newly registered or unrecognized OAuth clients
• Monitor for unusual patterns of content creation, modification, or deletion that may indicate compromised access tokens
• Regularly audit active access tokens and revoke any that appear suspicious or unrecognized

How to Mitigate CVE-2025-12028

Immediate Actions Required

• Update IndieAuth plugin to the patched version immediately by applying WordPress Changeset #3384558
• Review all existing OAuth authorizations and revoke any suspicious or unrecognized access tokens
• Audit recent content changes on affected WordPress sites for signs of unauthorized modifications
• Consider temporarily disabling the IndieAuth plugin if immediate patching is not possible

Patch Information

The vulnerability has been addressed in WordPress Changeset #3384558, which implements proper nonce verification on the authorization endpoint. Site administrators should update to the latest version of the IndieAuth plugin through the WordPress plugin dashboard. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the IndieAuth plugin until the patch can be applied if immediate update is not feasible
• Implement additional Web Application Firewall rules to validate referrer headers and block suspicious cross-origin requests to the authorization endpoint
• Restrict access to wp-login.php?action=indieauth to trusted IP addresses if your user base is limited to known networks
• Enable additional authentication factors for WordPress admin accounts to reduce the impact of potential account compromise

# Example WAF rule to block suspicious IndieAuth requests (ModSecurity)
SecRule REQUEST_URI "@contains wp-login.php" \
    "id:100001,phase:1,deny,status:403,chain,msg:'Suspicious IndieAuth request blocked'"
    SecRule ARGS:action "@eq indieauth" "chain"
    SecRule REQUEST_HEADERS:Referer "!@contains your-domain.com"