CVE-2025-1320: Mtrv Teachpress CSRF Vulnerability

CVE-2025-1320 Overview

The teachPress plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 9.0.9. The flaw stems from missing or incorrect nonce validation on the import.php page. Unauthenticated attackers can delete imports by tricking a site administrator into clicking a crafted link or visiting a malicious page. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).

Critical Impact
Attackers can delete teachPress imports by luring an authenticated administrator into triggering a forged request, resulting in loss of publication and course data managed by the plugin.

Affected Products

teachPress plugin for WordPress — all versions up to and including 9.0.9
Vendor: mtrv
WordPress sites using teachPress for academic publication and course management

Discovery Timeline

2025-03-25 - CVE-2025-1320 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1320

Vulnerability Analysis

teachPress is a WordPress plugin used to manage publications, courses, and student enrollments in academic environments. The plugin exposes an import.php administrative endpoint that handles operations against previously imported datasets, including deletion. The vulnerability arises because this endpoint does not properly validate a WordPress nonce token before performing state-changing operations.

Without valid nonce enforcement, the endpoint cannot distinguish between a legitimate administrator-initiated request and a request forged by a third-party site. An attacker who lures an authenticated administrator into visiting an attacker-controlled page can cause the administrator's browser to submit a request that deletes teachPress imports. The attack requires user interaction and does not need attacker authentication.

Root Cause

The root cause is missing or incorrect nonce validation on the import.php page. WordPress provides the wp_nonce_field() and check_admin_referer() / wp_verify_nonce() primitives to protect state-changing admin actions, but the affected code path in teachPress fails to enforce these checks. As a result, requests originating from a foreign origin are processed identically to those originating from the plugin's own admin UI.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a malicious HTML page or link that submits a request to the vulnerable import.php endpoint on the target WordPress site. When a logged-in teachPress administrator visits the attacker's page, the browser automatically attaches the administrator's session cookies to the forged request, and the server executes the import deletion. The impact is limited to integrity (loss of imported data); confidentiality and availability of the broader site are not directly affected. See the Wordfence Vulnerability Analysis for additional technical details.

// No verified public exploit code is available for CVE-2025-1320.
// The vulnerability mechanism is a missing WordPress nonce check on
// the teachPress import.php admin endpoint, allowing a forged
// cross-origin request to trigger import deletion when submitted
// by an authenticated administrator's browser.

Detection Methods for CVE-2025-1320

Indicators of Compromise

Unexpected deletion of teachPress import records without a corresponding administrator action in audit logs.
HTTP POST or GET requests to wp-admin/admin.php?page=teachpress/*import.php* with an external Referer header.
Administrator session activity originating from unusual pages immediately preceding teachPress data loss events.

Detection Strategies

Inspect web server access logs for requests to teachPress import.php where the Referer header points to a domain outside the site's own origin.
Correlate WordPress user activity logs with teachPress database changes to identify import deletions not preceded by legitimate admin navigation.
Deploy a Web Application Firewall (WAF) rule that flags cross-origin state-changing requests to /wp-admin/ paths lacking a valid _wpnonce parameter.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record all administrative actions performed against teachPress data.
Monitor the teachPress version installed on managed WordPress sites and alert when versions at or below 9.0.9 are detected.
Review referer patterns for authenticated admin sessions and investigate any external referers preceding data modifications.

How to Mitigate CVE-2025-1320

Immediate Actions Required

Update the teachPress plugin to a version newer than 9.0.9 as soon as a patched release is available from the WordPress teachPress plugin page.
Restrict access to the WordPress admin area (/wp-admin/) using IP allowlisting or a reverse-proxy authentication layer where feasible.
Instruct administrators to log out of WordPress when not actively managing the site to limit the window for CSRF exploitation.

Patch Information

The fix is tracked in the WordPress Plugin Changeset for teachPress. Site operators should upgrade to the latest release of the plugin from the official WordPress plugin directory. The patch adds proper nonce validation to the import.php administrative endpoint so that only requests originating from the plugin's own admin interface are accepted.

Workarounds

If an immediate update is not possible, deactivate the teachPress plugin until a patched version is installed.
Configure a WAF to block requests to teachPress admin endpoints that lack a valid _wpnonce parameter or that carry a cross-origin Referer header.
Enforce browser-side protections such as SameSite=Lax or SameSite=Strict cookies on the WordPress session cookie to reduce CSRF exposure.

bash

# Example: block cross-origin POSTs to teachPress import.php at the WAF/nginx layer
location ~* /wp-admin/admin\.php {
    if ($arg_page ~* "teachpress") {
        if ($http_referer !~* "^https?://your-site\.example/") {
            return 403;
        }
    }
}