CVE-2025-13621: WordPress Dream Gallery CSRF Vulnerability

CVE-2025-13621 Overview

CVE-2025-13621 is a Cross-Site Request Forgery [CWE-352] vulnerability in the Dream Gallery plugin for WordPress. The flaw affects all versions up to and including 1.0. The plugin's dreampluginsmain AJAX action lacks proper nonce validation, allowing unauthenticated attackers to update plugin settings and inject malicious web scripts. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. Successful exploitation results in stored script injection that executes in the context of visitors viewing affected gallery pages.

Critical Impact
Unauthenticated attackers can modify plugin settings and inject persistent JavaScript into WordPress sites by tricking an administrator into interacting with a forged request.

Affected Products

WordPress Dream Gallery plugin versions up to and including 1.0
WordPress sites with the plugin active and administrator sessions available
Downstream site visitors exposed to injected front-end scripts

Discovery Timeline

2025-12-05 - CVE-2025-13621 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13621

Vulnerability Analysis

The Dream Gallery plugin exposes an AJAX endpoint registered under the dreampluginsmain action. This handler updates plugin configuration values that are subsequently rendered by the plugin's front-end template. The handler does not verify a WordPress nonce before processing the incoming request. Because WordPress uses cookie-based authentication, any request originating from an authenticated administrator's browser inherits the administrator's session. An attacker who convinces an administrator to load an external page can trigger a background request to the vulnerable endpoint. The stored settings are later output by the plugin's front-end template, producing a stored Cross-Site Scripting condition against site visitors.

Root Cause

The vulnerability stems from missing or incorrect nonce validation on the dreampluginsmain AJAX action. WordPress provides check_ajax_referer() and wp_verify_nonce() specifically to bind state-changing AJAX handlers to a valid, session-derived token. The affected handler in dreamgallery.php accepts POST data and updates plugin settings without invoking these checks. Combined with the absence of output escaping in templates/front.php, the missing anti-CSRF token allows attacker-controlled input to become executable script on the front end.

Attack Vector

An attacker hosts a page containing an auto-submitting form or fetch() call targeting the WordPress site's admin-ajax.php endpoint with action=dreampluginsmain and malicious payload parameters. The attacker sends the link to a WordPress administrator through phishing, forum comments, or another channel. When the administrator visits the page while logged in, the browser sends authenticated cookies with the forged request. The plugin accepts the request and persists the injected content, which then executes in the browsers of subsequent visitors.

See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable handler location.

Detection Methods for CVE-2025-13621

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with the parameter action=dreampluginsmain originating from external referrers
Modifications to Dream Gallery plugin settings in the wp_options table without a corresponding administrator session entry in access logs
Presence of <script> tags, event handlers, or external JavaScript sources in gallery configuration values rendered by templates/front.php

Detection Strategies

Review web server access logs for cross-origin Referer headers on POST requests to admin-ajax.php targeting the dreampluginsmain action
Inspect plugin option values for HTML or JavaScript content that should not appear in configuration strings
Monitor administrator browser sessions for outbound requests to unrecognized domains immediately preceding plugin setting changes

Monitoring Recommendations

Enable WordPress activity logging to record option updates and correlate them with administrator authentication events
Alert on any changes to Dream Gallery settings originating outside the WordPress admin dashboard
Deploy Content Security Policy headers to detect and block execution of unexpected inline scripts on public gallery pages

How to Mitigate CVE-2025-13621

Immediate Actions Required

Deactivate and remove the Dream Gallery plugin until a patched version is released, since all versions through 1.0 are affected
Audit wp_options entries owned by the plugin and remove any values containing script content or unexpected HTML
Force logout of all administrator sessions and rotate credentials if a compromise is suspected

Patch Information

At the time of publication, no fixed version is listed for the Dream Gallery plugin. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a release that adds nonce validation to the dreampluginsmain AJAX action.

Workarounds

Restrict access to /wp-admin/admin-ajax.php from untrusted origins using a web application firewall rule that blocks requests with the dreampluginsmain action lacking a valid _wpnonce parameter
Require administrators to use a separate browser profile for WordPress management to reduce exposure to CSRF payloads delivered through general browsing
Apply strict SameSite=Lax or SameSite=Strict cookie attributes to WordPress authentication cookies where compatible with the site's workflow

bash

# Example WAF rule to block unauthenticated dreampluginsmain requests
# (ModSecurity syntax)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1013621,\
   msg:'Block CVE-2025-13621 CSRF against Dream Gallery'"
  SecRule ARGS:action "@streq dreampluginsmain" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"