CVE-2025-13413: WordPress Country Blocker CSRF Vulnerability

CVE-2025-13413 Overview

CVE-2025-13413 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Country Blocker for AdSense plugin for WordPress in all versions up to and including 1.0. The flaw stems from missing nonce validation on the CBFA_guardar_cbfa() function. Unauthenticated attackers can update the plugin's settings by tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page. The vulnerability is classified under [CWE-352] and requires user interaction to succeed. Exploitation does not require authentication on the target site, but a logged-in administrator must perform the triggering action.

Critical Impact
Successful exploitation lets an unauthenticated attacker modify Country Blocker for AdSense plugin settings on behalf of an administrator, altering AdSense geo-blocking behavior on the affected WordPress site.

Affected Products

Country Blocker for AdSense plugin for WordPress — all versions up to and including 1.0
WordPress sites with the affected plugin installed and active
Administrator accounts on those WordPress sites (required as the CSRF victim)

Discovery Timeline

2026-02-19 - CVE-2025-13413 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13413

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw in the Country Blocker for AdSense WordPress plugin. The plugin exposes a settings update handler, CBFA_guardar_cbfa(), that processes administrator settings changes without validating a WordPress nonce token. WordPress nonces are the framework's standard CSRF defense and bind a state-changing request to a specific user session and action.

Because the handler does not call wp_verify_nonce() or check_admin_referer() before applying changes, the server accepts any well-formed request with valid administrator session cookies. An attacker hosts a page that auto-submits a forged POST request to the plugin's settings endpoint. When an authenticated administrator visits that page, the browser attaches the WordPress session cookies and the server processes the request as legitimate.

The EPSS score of 0.016% reflects low predicted exploitation activity, consistent with a CSRF flaw that requires social engineering and a privileged victim. Impact is limited to plugin configuration integrity; confidentiality and availability of the broader site are not directly affected.

Root Cause

The root cause is missing nonce validation in the CBFA_guardar_cbfa() function. The handler relies solely on the administrator's authenticated session and does not verify request origin or intent. This pattern is a well-known anti-pattern in WordPress plugin development and maps directly to [CWE-352] Cross-Site Request Forgery.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts an HTML page containing an auto-submitting form or image tag that issues a POST request to the WordPress admin endpoint handled by CBFA_guardar_cbfa(). The attacker then delivers the link through phishing, a comment, or any channel that reaches a site administrator. When the administrator clicks the link while logged into WordPress, the browser sends the forged request with valid session cookies and the plugin updates its settings without confirmation. No authentication credentials are exposed, but plugin configuration integrity is compromised. See the Wordfence Vulnerability Report and the affected source line in the WordPress Plugin Version 1.0 for the vulnerable code location.

Detection Methods for CVE-2025-13413

Indicators of Compromise

Unexpected modifications to Country Blocker for AdSense plugin settings without a corresponding administrator session in WordPress audit logs.
HTTP POST requests to the plugin's settings handler with a Referer header pointing to an external or unfamiliar domain.
Requests to wp-admin endpoints that lack the _wpnonce or _wp_http_referer parameters typical of legitimate admin form submissions.

Detection Strategies

Monitor WordPress access logs for POST requests targeting the plugin's admin page where the Referer header is missing, empty, or originates from a third-party domain.
Enable a WordPress activity logging plugin to record option changes and correlate them with admin user sessions and source IP addresses.
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to wp-admin without an accompanying valid nonce parameter.

Monitoring Recommendations

Alert on any change to Country Blocker for AdSense settings outside of scheduled administrative maintenance windows.
Track administrator browsing telemetry for navigation to untrusted external URLs immediately preceding plugin configuration changes.
Review WordPress option table changes (wp_options) for entries written by the plugin and compare against expected administrator activity.

How to Mitigate CVE-2025-13413

Immediate Actions Required

Deactivate the Country Blocker for AdSense plugin until a patched version is available, given that all versions up to and including 1.0 are affected.
Audit recent plugin settings for unauthorized changes and restore the intended geo-blocking configuration.
Require administrators to log out of WordPress sessions before browsing untrusted sites or clicking unsolicited links.

Patch Information

At the time of NVD publication, no patched version of the Country Blocker for AdSense plugin has been identified in the available references. Monitor the WordPress Plugin Trunk Version and the Wordfence Vulnerability Report for an updated release that adds nonce validation to CBFA_guardar_cbfa().

Workarounds

Remove the plugin entirely and substitute another maintained geo-blocking solution that implements WordPress nonce validation.
Place the WordPress admin area behind an additional access control layer such as IP allowlisting or HTTP basic authentication on /wp-admin/.
Configure a WAF to block POST requests to plugin admin endpoints that lack a valid _wpnonce parameter or carry a cross-origin Referer header.

bash

# Example: restrict wp-admin to known administrator IPs via .htaccess
<Files "admin.php">
  Require ip 203.0.113.10
  Require ip 198.51.100.0/24
</Files>