CVE-2025-12412: WordPress Top Bar Notification CSRF Flaw

CVE-2025-12412 Overview

The Top Bar Notification plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.12. The flaw resides in the tbn_ajax_add() function, which lacks proper nonce validation. Unauthenticated attackers can exploit this weakness to update the plugin's settings and inject malicious web scripts. Successful exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).

Critical Impact
Attackers can modify plugin settings and inject arbitrary scripts into the WordPress front-end, enabling stored cross-site scripting attacks against site visitors when administrators are socially engineered into triggering the request.

Affected Products

WordPress Top Bar Notification plugin versions up to and including 1.12
WordPress installations with the plugin active and an administrator account
Sites where administrators may be targeted through phishing or malicious links

Discovery Timeline

2025-11-04 - CVE-2025-12412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12412

Vulnerability Analysis

The vulnerability originates in the tbn_ajax_add() AJAX handler within the Top Bar Notification plugin. WordPress plugins are expected to validate a nonce token on state-changing requests using functions such as check_ajax_referer() or wp_verify_nonce(). This handler either omits the nonce check entirely or implements it incorrectly, leaving no cryptographic binding between the request and an authenticated administrator session.

Because the endpoint accepts settings updates without CSRF protection, any authenticated administrator who loads an attacker-controlled page will silently submit the forged request. The AJAX handler processes the request under the administrator's privileges, applying attacker-supplied values to the plugin's notification content. The content is then rendered in the site's top bar, allowing script payloads to execute in the browser of every visitor.

Root Cause

The root cause is missing or incorrect nonce validation on the tbn_ajax_add() function, referenced at lines 75 and 102 of Notification.php in the plugin release 1.12. Without a valid nonce check, the plugin cannot distinguish between an intentional administrator action and a request forged by a third-party origin.

Attack Vector

Exploitation requires no authentication on the attacker's side but does require user interaction from a privileged victim. An attacker crafts an HTML page containing a form or JavaScript that posts to the vulnerable AJAX endpoint. When a logged-in administrator visits the page, typically after being lured through phishing, the browser attaches session cookies to the request. The plugin accepts the request as legitimate and stores the attacker's payload. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review for technical details.

Detection Methods for CVE-2025-12412

Indicators of Compromise

Unexpected content, HTML tags, or <script> payloads rendered in the WordPress top bar notification area
Administrator-authored changes to Top Bar Notification settings that do not correspond to legitimate admin activity in the audit log
HTTP POST requests to admin-ajax.php with the action=tbn_ajax_add parameter originating from external Referer headers

Detection Strategies

Review web server access logs for POST requests to wp-admin/admin-ajax.php invoking the tbn_ajax_add action with off-site Referer values
Compare current plugin option values in the wp_options table against known-good baselines to identify unauthorized modifications
Inspect rendered page source on public-facing pages for injected script tags within the top bar notification markup

Monitoring Recommendations

Enable WordPress activity logging to capture settings changes and correlate them with authenticated administrator sessions
Alert on outbound browser requests from administrator workstations to unfamiliar domains immediately preceding plugin setting changes
Monitor file integrity and database option changes for the Top Bar Notification plugin on all WordPress hosts

How to Mitigate CVE-2025-12412

Immediate Actions Required

Deactivate the Top Bar Notification plugin until a patched release is confirmed available and installed
Audit the plugin's stored settings for injected HTML or JavaScript and reset them to known-good values
Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for admin work

Patch Information

At the time of publication, no fixed version is listed in the referenced advisory beyond 1.12. Site operators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for a release that adds check_ajax_referer() validation to tbn_ajax_add(). Apply the update as soon as it is available.

Workarounds

Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule that requires a valid Referer header matching the site origin
Implement a WAF rule that blocks requests to the tbn_ajax_add action lacking a valid WordPress nonce parameter
Enforce SameSite=Strict cookies for the WordPress administrator session where compatible with the site configuration

bash

# Example WAF rule concept: block cross-origin POSTs to the vulnerable AJAX action
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1012412,msg:'CVE-2025-12412 CSRF block'"
SecRule ARGS:action "@streq tbn_ajax_add" \
  "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"