CVE-2025-13142 Overview
CVE-2025-13142 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Custom Post Type plugin for WordPress in all versions up to and including 1.0. The flaw stems from missing nonce validation on the custom post type deletion functionality. Unauthenticated attackers can delete custom post types by tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. The vulnerability is classified under [CWE-352] Cross-Site Request Forgery. Successful exploitation results in unauthorized modification of site content through deletion of registered custom post types.
Critical Impact
Unauthenticated attackers can delete WordPress custom post types by tricking an authenticated administrator into loading a forged request.
Affected Products
- Custom Post Type plugin for WordPress — all versions up to and including 1.0
- WordPress sites with the vulnerable plugin activated
- Administrator sessions on affected WordPress installations
Discovery Timeline
- 2025-11-21 - CVE-2025-13142 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13142
Vulnerability Analysis
The Custom Post Type plugin exposes an administrative action that deletes custom post types without verifying a WordPress nonce token. The deletion handler in cupta-dmin.php processes state-changing requests based solely on the authenticated user's session cookies. WordPress relies on nonce tokens to bind sensitive actions to a specific user and session, preventing forged cross-origin requests from triggering administrative operations. Because the plugin omits wp_verify_nonce() or check_admin_referer() on the deletion endpoint, any request carrying a valid administrator cookie will succeed regardless of origin.
Root Cause
The root cause is missing nonce validation on the custom post type deletion handler. The vulnerable code path executes deletion logic without invoking WordPress's built-in CSRF protection primitives. Review of the plugin source in cupta-dmin.php confirms the handler dispatches on request parameters alone. See the WordPress Plugin Code Review for the specific code location.
Attack Vector
An attacker crafts a malicious webpage or email containing a link or auto-submitting form that targets the plugin's deletion endpoint. When an authenticated administrator visits the attacker-controlled resource, the browser transmits session cookies alongside the forged request. The WordPress backend accepts the request as legitimate and deletes the specified custom post type. Exploitation requires user interaction from a privileged administrator but no attacker authentication. See the Wordfence Vulnerability Report for additional technical detail.
No verified public proof-of-concept code is available. The exploitation pattern follows standard CSRF techniques: an HTML page hosted externally that issues a GET or POST request to the vulnerable administrative endpoint on the target WordPress site.
Detection Methods for CVE-2025-13142
Indicators of Compromise
- Unexpected deletion events for custom post types in WordPress audit logs
- HTTP requests to the plugin's admin endpoint with Referer headers pointing to external, untrusted domains
- Administrator session activity coinciding with visits to unfamiliar external sites or email links
Detection Strategies
- Inspect web server access logs for requests targeting cupta-dmin.php that originate from off-site referrers while carrying an admin cookie
- Monitor WordPress database changes for unexplained removal of registered custom post types
- Enable a WordPress audit-logging plugin to capture post type registration and deletion events with actor attribution
Monitoring Recommendations
- Alert on administrative state changes performed without a corresponding authenticated admin dashboard session
- Track outbound browsing activity from administrator workstations that immediately precedes destructive backend actions
- Correlate WAF logs for POST or GET requests to plugin admin scripts lacking WordPress nonce parameters
How to Mitigate CVE-2025-13142
Immediate Actions Required
- Deactivate and remove the Custom Post Type plugin until a patched version is released
- Audit existing custom post types and back up post type registrations and associated content
- Instruct administrators to log out of the WordPress admin panel before browsing external sites or clicking untrusted links
Patch Information
No vendor patch is referenced in the available advisory data at time of publication. Site operators should monitor the Wordfence Vulnerability Report and the plugin's page on the WordPress plugin repository for an updated release that adds nonce validation to the deletion handler.
Workarounds
- Uninstall the plugin and replace it with a maintained alternative that enforces check_admin_referer() on state-changing actions
- Deploy a web application firewall rule that blocks requests to plugin admin endpoints missing a valid _wpnonce parameter
- Restrict WordPress administrator sessions with SameSite cookie policies and short session lifetimes to reduce CSRF exposure
# Example WAF rule concept (ModSecurity) to block plugin admin requests lacking a nonce
SecRule REQUEST_URI "@contains cupta-dmin.php" \
"chain,deny,status:403,id:1013142,msg:'Blocked CSRF attempt on Custom Post Type plugin'"
SecRule &ARGS:_wpnonce "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
