CVE-2025-12410: SH Contextual Help Plugin CSRF Vulnerability

CVE-2025-12410 Overview

CVE-2025-12410 is a Cross-Site Request Forgery (CSRF) vulnerability in the SH Contextual Help plugin for WordPress. The flaw affects all versions up to and including 3.2.1. The vulnerability originates in the sh_contextual_help_dashboard_widget() function, which lacks proper nonce validation. Unauthenticated attackers can update the plugin's settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to modify plugin settings and inject stored scripts into the WordPress dashboard, potentially leading to persistent XSS against administrators.

Affected Products

SH Contextual Help plugin for WordPress — all versions through 3.2.1
WordPress sites with the plugin installed and an authenticated administrator session
Deployments where administrators can be socially engineered into visiting attacker-controlled links

Discovery Timeline

2025-11-04 - CVE-2025-12410 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12410

Vulnerability Analysis

The SH Contextual Help plugin exposes an administrative settings handler through the sh_contextual_help_dashboard_widget() function. WordPress plugins typically protect state-changing operations by issuing a nonce with wp_create_nonce() and validating it with check_admin_referer() or wp_verify_nonce(). In the vulnerable versions, this validation is either missing or incorrectly implemented. As a result, the request-processing logic accepts POST parameters without confirming that the request originated from a legitimate administrator session.

The secondary consequence is script injection. Because settings values are stored and later rendered without adequate sanitization, an attacker can persist malicious JavaScript through the same forged request. When an administrator loads the dashboard, the injected payload executes in the browser context.

Root Cause

The root cause is missing anti-CSRF token verification in the settings update path of sh_contextual_help_dashboard_widget(). See the plugin source at line 400, line 402, and line 417 for the vulnerable handler.

Attack Vector

Exploitation requires user interaction from a privileged user. An attacker hosts a page containing an auto-submitting form or crafted image tag that issues a POST request to the target WordPress admin endpoint. If a logged-in administrator visits that page, the browser attaches session cookies and the plugin processes the request as if the administrator had authorized it. The attacker uses this primitive to overwrite plugin settings with a JavaScript payload, converting the CSRF into stored Cross-Site Scripting.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-12410

Indicators of Compromise

Unexpected modifications to SH Contextual Help plugin settings in the wp_options table, particularly entries containing <script> tags or JavaScript event handlers
Administrator browser sessions loading unfamiliar external scripts when viewing the WordPress dashboard
HTTP POST requests to plugin admin endpoints without a corresponding _wpnonce parameter or with a Referer header pointing to an external domain

Detection Strategies

Inspect web server access logs for POST requests targeting WordPress admin URLs where the Referer header does not match the site's own domain
Review the WordPress database for plugin option values containing HTML or script content that should not be present in configuration fields
Monitor file integrity of plugin directories and audit changes to sh_contextual_help option keys

Monitoring Recommendations

Enable and centralize WordPress audit logs to capture settings changes with associated user and IP context
Alert on admin dashboard page loads that trigger outbound requests to untrusted domains, which can indicate active stored XSS
Baseline expected plugin configuration values and flag deviations for review

How to Mitigate CVE-2025-12410

Immediate Actions Required

Deactivate the SH Contextual Help plugin on all WordPress sites until a patched release is confirmed installed
Audit plugin settings for injected script content and restore known-good values
Force reauthentication of administrator accounts and rotate any credentials that may have been exposed through stored XSS

Patch Information

At the time of publication, no fixed version beyond 3.2.1 is referenced in the NVD entry. Site owners should monitor the WordPress plugin repository and the Wordfence advisory for a security release that adds nonce validation to sh_contextual_help_dashboard_widget().

Workarounds

Restrict administrator browsing to trusted sites when authenticated to the WordPress admin panel, ideally using a dedicated browser profile
Deploy a Web Application Firewall rule that blocks POST requests to WordPress admin endpoints missing a valid _wpnonce parameter
Apply a Content Security Policy that disallows inline script execution in the WordPress admin interface to reduce the impact of injected payloads

bash

# Example WAF rule concept blocking admin POSTs without a nonce token
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1012410,phase:2,deny,status:403,msg:'WP admin POST missing nonce'"
  SecRule REQUEST_URI "@contains /wp-admin/" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"