CVE-2025-13134 Overview
CVE-2025-13134 is a Cross-Site Request Forgery (CSRF) vulnerability in the AuthorSure plugin for WordPress. The flaw affects all versions up to and including 2.3. The plugin fails to properly validate nonces on the authorsure settings page. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows attackers to modify plugin settings and inject persistent scripts that execute in administrator or visitor browser sessions, enabling stored Cross-Site Scripting (XSS) attacks against WordPress sites.
Affected Products
- AuthorSure plugin for WordPress — all versions through 2.3
- WordPress sites with the vulnerable plugin activated
- Administrator sessions accessing the authorsure settings page
Discovery Timeline
- 2025-11-21 - CVE-2025-13134 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13134
Vulnerability Analysis
The AuthorSure plugin exposes a settings endpoint on the authorsure administrative page. This endpoint accepts POST requests to update plugin configuration values. The handler processes these requests without verifying a valid WordPress nonce token. As a result, the server cannot distinguish between legitimate administrator submissions and forged requests originating from external sites.
An attacker crafts a malicious page containing an auto-submitting form or JavaScript that targets the settings endpoint. When an authenticated administrator visits the page, the browser attaches the WordPress session cookie to the outgoing request. The plugin processes the request as legitimate and applies attacker-controlled values. Because the updated settings are rendered without sufficient output encoding, injected script payloads execute in the browser context of anyone viewing the affected pages.
Root Cause
The root cause is missing or incorrect nonce validation on the authorsure settings handler. WordPress provides wp_verify_nonce() and check_admin_referer() to bind state-changing requests to the current user session. The plugin either omits these checks or applies them incorrectly, breaking the CSRF protection model that WordPress expects for administrative actions.
Attack Vector
Exploitation requires user interaction. An attacker must lure a logged-in administrator to a controlled page or a link containing the forged request. No authentication or prior access to the target site is required from the attacker. The scope changes because the injected script executes in the WordPress origin, allowing the payload to access administrator cookies and DOM content beyond the vulnerable component.
See the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-13134
Indicators of Compromise
- Unexpected changes to AuthorSure plugin settings without corresponding administrator activity in audit logs
- Presence of <script> tags or JavaScript event handlers in plugin configuration fields
- HTTP POST requests to the authorsure admin page originating from external Referer headers
- Outbound requests from visitor browsers to unfamiliar domains after loading pages rendered by the plugin
Detection Strategies
- Monitor WordPress wp-admin access logs for POST requests to the authorsure page with cross-origin Referer values
- Review plugin settings tables in the database for embedded HTML or script content that should not appear in configuration values
- Correlate administrator authentication events with configuration change timestamps to identify inconsistencies
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all administrative setting changes with timestamps and source IPs
- Deploy a Web Application Firewall (WAF) rule set that flags requests to plugin admin endpoints missing valid _wpnonce parameters
- Alert on any modification to the AuthorSure options row in the wp_options table
How to Mitigate CVE-2025-13134
Immediate Actions Required
- Deactivate the AuthorSure plugin until a patched version above 2.3 is available from the vendor
- Audit the plugin settings and remove any unexpected script content or unauthorized configuration changes
- Force password resets for administrator accounts if compromise is suspected
- Invalidate active WordPress sessions to revoke any hijacked authentication cookies
Patch Information
At the time of publication, no fixed version has been listed in the referenced advisories for versions above 2.3. Site owners should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a security release that adds proper nonce validation on the authorsure settings handler.
Workarounds
- Restrict access to /wp-admin/ by IP address using web server configuration to reduce exposure to CSRF payloads
- Require administrators to use separate browser profiles or private browsing sessions when managing WordPress
- Deploy a WAF rule blocking requests to the authorsure admin page that lack a valid same-origin Referer header
- Remove the plugin entirely if AuthorSure functionality is not essential to site operation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
