CVE-2025-13629: WP Landing Page Plugin CSRF Vulnerability

CVE-2025-13629 Overview

CVE-2025-13629 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the WP Landing Page plugin for WordPress in all versions up to and including 0.9.3. The flaw exists because the wplp_api_update_text function does not perform nonce validation. Unauthenticated attackers can craft forged requests that update arbitrary post meta if a site administrator is tricked into clicking a malicious link. The vulnerability carries a CVSS 3.1 base score of 4.3 and requires user interaction to succeed. Exploitation impacts data integrity but does not directly affect confidentiality or availability.

Critical Impact

An attacker can modify arbitrary post metadata on WordPress sites running vulnerable versions of WP Landing Page by tricking an administrator into visiting an attacker-controlled page.

Affected Products

• WP Landing Page plugin for WordPress — all versions through 0.9.3
• WordPress sites with the plugin installed and activated
• Administrator sessions authenticated to affected sites

Discovery Timeline

• 2025-12-06 - CVE-2025-13629 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13629

Vulnerability Analysis

The vulnerability resides in the wplp_api_update_text function within the plugin's includes/wplp-api.php file. The function handles requests to update post meta values used by the landing page builder. However, it lacks a WordPress nonce check, which is the standard mechanism for verifying that a request originated from a legitimate, intended user action.

Because the endpoint does not validate a nonce token, any authenticated administrator's browser can be coerced into submitting a state-changing request to this endpoint. The forged request executes with the administrator's session cookies attached, allowing the attacker to modify arbitrary post meta entries on the site.

The issue is classified as CWE-352 (Cross-Site Request Forgery). It requires user interaction, typically achieved by luring an administrator to click a link or visit an attacker-controlled page containing a hidden form or JavaScript payload that auto-submits.

Root Cause

The root cause is a missing call to wp_verify_nonce() or check_admin_referer() before processing incoming update requests in wplp_api_update_text. WordPress requires nonce validation on all state-changing operations to prevent cross-origin request forgery, and the plugin author omitted this control.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or fetch request targeting the vulnerable endpoint on a WP Landing Page site. When an authenticated administrator visits the attacker's page, the browser sends the request with valid session cookies. The server processes the request as legitimate and updates post meta values chosen by the attacker.

The vulnerability manifests in the request handler for updating landing page text. See the Wordfence Vulnerability Report and the WordPress Plugin Source for technical details.

Detection Methods for CVE-2025-13629

Indicators of Compromise

• Unexpected modifications to post meta fields associated with WP Landing Page content
• HTTP POST requests to plugin API endpoints with a Referer header pointing to external domains
• Administrator sessions generating landing page updates outside normal editing workflows
• Log entries showing plugin API calls without a corresponding admin dashboard navigation trail

Detection Strategies

• Review WordPress access logs for requests to wplp-api.php endpoints originating from unusual referrers
• Audit wp_postmeta table changes and correlate timestamps with administrator activity
• Deploy a Web Application Firewall (WAF) rule that inspects requests to the plugin's endpoints for missing or invalid nonce parameters
• Enable WordPress security plugin logging to capture state-changing API calls

Monitoring Recommendations

• Alert on modifications to post meta on pages managed by WP Landing Page outside business hours or from anomalous IPs
• Monitor for outbound clicks by administrators to untrusted domains via email gateway or browser isolation telemetry
• Track plugin file integrity to confirm the plugin version and any hotfix state

How to Mitigate CVE-2025-13629

Immediate Actions Required

• Deactivate the WP Landing Page plugin until a patched version is confirmed available and installed
• Restrict administrator browsing habits and enforce use of dedicated admin browsers or profiles
• Rotate administrator credentials if suspicious post meta changes are observed
• Review recent changes to landing page content and revert any unauthorized modifications

Patch Information

At the time of publication, all versions up to and including 0.9.3 are affected. Administrators should monitor the WordPress plugin repository for a release that adds nonce validation to the wplp_api_update_text function and update immediately when available.

Workarounds

• Temporarily disable or uninstall the WP Landing Page plugin until a fix is released
• Apply a WAF rule blocking POST requests to the vulnerable endpoint that lack a valid _wpnonce parameter
• Require administrators to log out of the WordPress admin session when not actively editing
• Enforce SameSite cookie attributes and Content Security Policy (CSP) directives to reduce cross-origin request risk

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_URI "@contains wplp-api.php" \
    "id:1013629,phase:2,deny,status:403,\
    chain,msg:'Block WP Landing Page CSRF - missing nonce'"
    SecRule &ARGS:_wpnonce "@eq 0"