CVE-2025-14615: Dashboard Builder WordPress CSRF Flaw

CVE-2025-14615 Overview

CVE-2025-14615 affects the DASHBOARD BUILDER WordPress plugin for Charts and Graphs in all versions up to and including 1.5.7. The plugin fails to validate nonce tokens on its settings handler in dashboardbuilder-admin.php. Unauthenticated attackers can forge requests that modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode. The modified query executes on the front-end when the shortcode renders, enabling arbitrary SQL injection and data exfiltration through publicly visible chart output. Exploitation requires tricking a site administrator into clicking a malicious link.

Critical Impact
A successful Cross-Site Request Forgery attack lets unauthenticated attackers inject arbitrary SQL queries that execute on the WordPress front-end, exposing database contents through rendered chart output.

Affected Products

DASHBOARD BUILDER – WordPress plugin for Charts and Graphs versions up to and including 1.5.7
WordPress sites rendering the [show-dashboardbuilder] shortcode
Any WordPress installation where an administrator is authenticated and reachable via social engineering

Discovery Timeline

2026-01-14 - CVE-2025-14615 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14615

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw classified under [CWE-352]. The Dashboard Builder plugin exposes a settings handler in dashboardbuilder-admin.php at line 158 that processes administrative changes without verifying a WordPress nonce. Without nonce validation, the handler cannot distinguish between a legitimate admin form submission and a forged cross-origin request.

The settings handler stores two attacker-controlled values: the SQL query executed by the chart shortcode and the database connection credentials. Both inputs are saved to the WordPress options table and later read by the [show-dashboardbuilder] shortcode logic in dashboardbuilder.php. The shortcode executes the stored query and renders the result set as a chart on any public page that embeds it.

This design turns a CSRF primitive into a persistent SQL injection. An attacker who lands a single forged request gains a stored, server-executed query that runs each time a visitor loads the page hosting the shortcode.

Root Cause

The root cause is missing nonce validation on a state-changing administrative endpoint. WordPress provides wp_verify_nonce() and check_admin_referer() to bind requests to a specific user session, but dashboardbuilder-admin.php omits both checks before writing the SQL query and credential fields to plugin options.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or image tag that targets the plugin's settings endpoint on the victim site. The attacker delivers the link through email, chat, or a comment on a site the administrator visits while authenticated. When the administrator loads the link, the browser sends the forged POST request with valid session cookies, and the plugin stores the attacker's SQL query. The next visitor to any page containing [show-dashboardbuilder] triggers execution of that query, returning rows that the shortcode renders publicly.

No authentication or privilege is required from the attacker. The only prerequisite is user interaction from an authenticated administrator, consistent with the User Interaction Required component of the CVSS vector.

Detection Methods for CVE-2025-14615

Indicators of Compromise

Unexpected modifications to Dashboard Builder plugin options containing SQL keywords such as UNION, SELECT, or INFORMATION_SCHEMA in stored query fields
Database connection strings in plugin settings that point to hosts other than the local WordPress database
Chart output on public pages displaying user table contents, password hashes, or option values not intended for public view
Web server access logs showing POST requests to the plugin admin endpoint from external Referer headers

Detection Strategies

Audit the wp_options table for Dashboard Builder entries and review the stored query string for unauthorized changes
Inspect the rendered HTML of pages using [show-dashboardbuilder] for sensitive column names or data patterns
Monitor administrator session activity for requests to dashboardbuilder-admin.php originating from off-site Referer values
Correlate plugin setting changes with the timestamp of administrator clicks on external links

Monitoring Recommendations

Enable WordPress audit logging to capture option updates tied to the Dashboard Builder plugin
Forward web server and WordPress logs to a centralized analytics platform for anomaly detection on admin endpoints
Alert on outbound database connections from the WordPress host to unexpected destinations
Track HTTP requests carrying SQL syntax in POST bodies to plugin admin handlers

How to Mitigate CVE-2025-14615

Immediate Actions Required

Deactivate and remove the Dashboard Builder plugin until a patched release is available
Audit wp_options entries created by the plugin and revert any unauthorized query or credential changes
Rotate database credentials if the plugin's stored connection settings were modified
Review all pages containing the [show-dashboardbuilder] shortcode and remove the shortcode while the plugin remains unpatched

Patch Information

No fixed version is identified in the NVD record at publication. All versions up to and including 1.5.7 are vulnerable. Monitor the Wordfence Vulnerability Report and the WordPress Plugin Admin File source tree for an updated release that adds nonce validation.

Workarounds

Restrict access to /wp-admin/ paths by IP allowlist at the web server or WAF layer
Require administrators to use a dedicated browser profile or session for WordPress admin work to limit CSRF exposure
Deploy a web application firewall rule that blocks POST requests to the plugin admin handler lacking a valid same-origin Referer
Disable the [show-dashboardbuilder] shortcode by removing it from published content until a patch is applied