CVE-2025-14167: WordPress Remove Post Type Slug CSRF Flaw

CVE-2025-14167 Overview

The Remove Post Type Slug plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.2. The flaw stems from incorrect nonce validation logic in the plugin's administrative functions, which uses an OR (||) operator instead of an AND (&&) operator. This logical error causes the validation to fail when the nonce field is not empty OR when verification fails, rather than the intended behavior of failing when the nonce field is empty AND verification fails.

Critical Impact

Unauthenticated attackers can modify the plugin's post type slug removal settings via a forged request if they can trick a site administrator into clicking on a malicious link.

Affected Products

• Remove Post Type Slug plugin for WordPress versions up to and including 1.0.2

Discovery Timeline

• 2026-02-19 - CVE-2025-14167 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-14167

Vulnerability Analysis

This CSRF vulnerability arises from a fundamental logical error in the nonce validation implementation within the class-remove-post-type-slug-admin.php file. The incorrect use of the logical OR operator instead of AND means the security check can be bypassed under certain conditions, leaving administrative functions unprotected against cross-site request forgery attacks.

The vulnerability requires user interaction—specifically, a site administrator must be tricked into performing an action such as clicking on a malicious link. Once the administrator interacts with the forged request, the attacker can modify the plugin's post type slug removal settings without authorization.

Root Cause

The root cause is a programming error in the nonce validation conditional statement. The code at line 127 of class-remove-post-type-slug-admin.php uses || (OR) instead of && (AND) in the validation logic. This means the validation fails when either condition is true, rather than when both conditions are true simultaneously. This inverted logic allows attackers to craft requests that bypass the intended security mechanism.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious webpage or link containing a forged request that targets the vulnerable plugin endpoint. The attack requires social engineering to trick an authenticated WordPress administrator into visiting the attacker-controlled page or clicking the malicious link while logged into their WordPress site. Upon successful exploitation, the attacker can modify the plugin's settings, potentially affecting URL structures and site functionality.

The vulnerability mechanism involves the incorrect nonce validation logic in the admin settings handler. When a properly formatted request is submitted, the flawed conditional check using OR instead of AND allows the request to proceed even when proper nonce verification should have blocked it. For technical details, see the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-14167

Indicators of Compromise

• Unexpected changes to post type slug settings without administrator action
• WordPress audit logs showing settings modifications from unusual IP addresses or at unexpected times
• Web server logs containing suspicious POST requests to the plugin's admin endpoints from external referrers

Detection Strategies

• Review WordPress site audit logs for unauthorized modifications to Remove Post Type Slug plugin settings
• Monitor web application firewall (WAF) logs for CSRF attack patterns targeting WordPress admin endpoints
• Implement Content Security Policy (CSP) headers to detect and prevent cross-site request forgery attempts

Monitoring Recommendations

• Enable comprehensive logging for WordPress administrative actions and plugin settings changes
• Configure alerts for settings modifications occurring outside normal administrative activity windows
• Deploy a web application firewall capable of detecting CSRF attack patterns against WordPress installations

How to Mitigate CVE-2025-14167

Immediate Actions Required

• Update the Remove Post Type Slug plugin to the latest version that includes the nonce validation fix
• Review plugin settings to verify no unauthorized modifications have occurred
• Educate WordPress administrators about the risks of clicking unknown links while logged into the admin panel
• Consider temporarily deactivating the plugin until a patch is applied

Patch Information

Organizations should check the WordPress plugin repository for updated versions of Remove Post Type Slug that address this CSRF vulnerability. The fix involves correcting the nonce validation logic from using OR (||) to AND (&&) operators in the conditional statement. Review the WordPress Plugin Trunk Code for the latest version.

Workarounds

• Implement additional CSRF protection at the web server or WAF level for WordPress admin endpoints
• Restrict admin panel access to trusted IP addresses only
• Use browser extensions or security plugins that provide additional CSRF protection
• Administrators should avoid clicking external links while logged into WordPress with administrative privileges

# Configuration example - Apache .htaccess to restrict admin access by IP
<Files "wp-admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>