CVE-2025-13521: WP Status Notifier CSRF Vulnerability

CVE-2025-13521 Overview

CVE-2025-13521 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Status Notifier plugin for WordPress in all versions up to and including 1.0. The flaw resides in the plugin's settings update functionality, which lacks proper nonce validation. Unauthenticated attackers can craft malicious requests that modify plugin settings when an authenticated administrator is tricked into clicking a crafted link. The weakness is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to alter WP Status Notifier plugin settings on affected WordPress sites by leveraging an administrator's authenticated session.

Affected Products

WP Status Notifier plugin for WordPress, all versions through 1.0
WordPress sites with the wp-change-status-notifier plugin installed and active
Administrator accounts with active authenticated sessions on affected sites

Discovery Timeline

2026-01-07 - CVE CVE-2025-13521 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13521

Vulnerability Analysis

The WP Status Notifier plugin exposes a settings update handler that processes administrator requests without verifying a WordPress nonce. WordPress nonces are anti-CSRF tokens that bind a request to a specific user session and action. Without nonce validation, the plugin cannot distinguish a legitimate administrator-initiated form submission from a forged cross-origin request.

The attack requires user interaction. An attacker must convince an authenticated administrator to visit a page or click a link that triggers a request to the vulnerable settings endpoint. Because the administrator's browser automatically includes WordPress session cookies, the forged request executes with administrator privileges. The impact is limited to integrity of plugin configuration; confidentiality and availability are not directly affected based on the recorded CVSS vector.

Root Cause

The root cause is missing or incorrect nonce validation in the plugin's options-page.php handler. The vulnerable code path accepts settings updates without invoking check_admin_referer() or wp_verify_nonce() against a request-bound token. Source references are available in the WordPress Plugin Options Page and the WordPress Plugin Trunk Options.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or image tag that issues a POST or GET request to the WP Status Notifier settings endpoint on the target site. The attacker then lures a logged-in administrator (via phishing email, forum link, or social media) to that page. The browser submits the request with the administrator's session cookies, and the plugin processes the settings change. No authentication credentials need to be known by the attacker. Additional analysis is published in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-13521

Indicators of Compromise

Unexpected modifications to WP Status Notifier plugin settings without a corresponding administrator-initiated change in audit logs
HTTP referer headers on plugin settings POST requests pointing to external domains rather than the WordPress admin interface
Administrator account activity originating from links delivered via email, chat, or external web pages immediately preceding configuration changes

Detection Strategies

Monitor web server access logs for POST requests to options-page.php or the plugin's settings handler with off-site Referer headers
Review WordPress audit logging plugins for plugin option changes that lack a corresponding admin session activity trail
Correlate browser history or email gateway telemetry with timestamps of plugin configuration changes to identify suspected CSRF lures

Monitoring Recommendations

Enable a WordPress activity logging plugin to record all option and settings changes with user attribution and source IP
Alert on plugin setting modifications outside of business hours or from unusual administrator workstations
Track outbound clicks from administrator mailboxes through email security gateways to detect potential CSRF lure delivery

How to Mitigate CVE-2025-13521

Immediate Actions Required

Deactivate and remove the WP Status Notifier plugin until a patched version is released, since all versions through 1.0 are affected
Audit current plugin settings and restore expected values if any unauthorized changes are identified
Instruct WordPress administrators to log out of the admin dashboard before browsing untrusted links or external content

Patch Information

No fixed version has been published as of the latest NVD update on 2026-04-15. Affected sites should remove the plugin or replace it with a maintained alternative. Monitor the WordPress Plugin Repository and the Wordfence Vulnerability Analysis for updates.

Workarounds

Restrict access to /wp-admin/ using IP allowlisting at the web server or WAF tier to limit who can submit authenticated requests
Deploy a web application firewall rule that requires a valid Referer or Origin header matching the site domain for POST requests to plugin settings endpoints
Use browser session isolation by reserving a dedicated browser profile for WordPress administration with no general web browsing
Enforce short admin session lifetimes and require re-authentication for sensitive plugin configuration changes

bash

# Example ModSecurity rule to block cross-origin POSTs to the plugin settings handler
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1005521,phase:2,deny,status:403,msg:'CVE-2025-13521 CSRF attempt'"
  SecRule REQUEST_URI "@contains /wp-admin/options-general.php" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/wp-admin/"