CVE-2025-13143: Opinion Stage WordPress Plugin CSRF Flaw

CVE-2025-13143 Overview

CVE-2025-13143 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress. The flaw affects all versions up to and including 19.12.0. It stems from missing or insufficient nonce validation on the disconnect_account_action function. Unauthenticated attackers can disconnect a WordPress site from the Opinion Stage platform integration by tricking an authenticated administrator into clicking a crafted link.

Critical Impact
Successful exploitation disrupts the Opinion Stage integration on affected WordPress sites, causing loss of connected polls, surveys, and quiz functionality tied to the platform account.

Affected Products

Poll, Survey & Quiz Maker Plugin by Opinion Stage for WordPress
All plugin versions up to and including 19.12.0
WordPress installations with the social-polls-by-opinionstage plugin active

Discovery Timeline

2025-11-27 - CVE-2025-13143 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13143

Vulnerability Analysis

The vulnerability resides in the plugin's administrative action handler responsible for disconnecting a WordPress site from the Opinion Stage service. The disconnect_account_action function in src/Modules/Admin.php executes state-changing operations without properly validating a WordPress nonce token. WordPress nonces serve as anti-CSRF tokens that bind a request to a specific user session and action.

Because the function does not verify request authenticity, any HTTP request that reaches the endpoint while an administrator's browser holds a valid WordPress session cookie is accepted. An attacker only needs to lure an authenticated administrator into loading an attacker-controlled page or clicking a crafted link. The browser automatically attaches the administrator's session cookies to the forged request.

The impact is limited to integrity of the Opinion Stage connection state. The vulnerability does not directly expose sensitive data or grant code execution, but disrupts the site's polling and survey infrastructure.

Root Cause

The root cause is missing or insufficient CSRF token validation on a privileged state-changing action. Referenced source lines 195–196 in src/Modules/Admin.php of tag 19.12.0 show the affected handler. The absence of a check_admin_referer() or wp_verify_nonce() call before executing the disconnect logic allows forged requests to succeed.

Attack Vector

The attack requires network access to the target site and user interaction from an administrator. An attacker crafts a malicious page containing an HTML form, image tag, or JavaScript request that targets the vulnerable disconnect endpoint. When a signed-in WordPress administrator visits the attacker's page, the browser issues the request with the admin's cookies attached, triggering the disconnect action without consent.

The vulnerability requires no authentication on the attacker's side. Delivery vectors include phishing emails, malicious advertising, forum posts, and comments containing links to attacker-controlled pages.

Detection Methods for CVE-2025-13143

Indicators of Compromise

Unexpected disconnection of the Opinion Stage integration inside the WordPress admin dashboard
HTTP requests to the disconnect_account_action endpoint originating from external referrers
WordPress admin activity logs showing account disconnect events without a corresponding administrator-initiated session
Missing or empty _wpnonce parameter on requests targeting the plugin's admin-post or admin-ajax handlers

Detection Strategies

Inspect web server access logs for POST or GET requests to admin-post.php or admin-ajax.php invoking the disconnect action with anomalous Referer headers pointing outside the WordPress site
Correlate integration state changes with administrator authentication events to identify actions performed via forged requests
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's admin action endpoints when the Referer header does not match the site origin

Monitoring Recommendations

Enable WordPress audit logging plugins to capture plugin configuration and integration state changes
Alert on any change to the Opinion Stage connection status outside expected administrative maintenance windows
Monitor outbound linking patterns in administrator email and messaging to identify social engineering attempts targeting privileged users

How to Mitigate CVE-2025-13143

Immediate Actions Required

Update the Poll, Survey & Quiz Maker Plugin by Opinion Stage to a version newer than 19.12.0 once the vendor publishes a fix
Restrict WordPress administrator browsing habits and enforce separation between administrative sessions and general web use
Review the current Opinion Stage integration status and reconnect the account if an unexpected disconnect occurred

Patch Information

At the time of publication, the Wordfence Vulnerability Report tracks the issue against plugin versions through 19.12.0. Site administrators should monitor the plugin's changelog and the WordPress Plugin Source Code repository for a patched release that introduces nonce validation on the disconnect_account_action handler.

Workarounds

Deactivate the plugin until a patched version is available if the Opinion Stage integration is not business-critical
Deploy a WAF rule that denies requests to the plugin's admin endpoints lacking a same-origin Referer header
Require administrators to use a dedicated browser or browser profile for WordPress management to reduce CSRF exposure from other tabs
Enforce short administrator session lifetimes and log out of the WordPress admin console when not in active use

bash

# Example WAF rule (ModSecurity) blocking off-origin requests to the plugin endpoint
SecRule REQUEST_URI "@contains admin-post.php" \
    "chain,deny,status:403,id:1013143,msg:'CVE-2025-13143 CSRF block'"
    SecRule ARGS:action "@streq disconnect_account_action" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"