CVE-2025-14615: Dashboard Builder WordPress Plugin CSRF

CVE-2025-14615 Overview

CVE-2025-14615 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the DASHBOARD BUILDER – WordPress plugin for Charts and Graphs in all versions up to and including 1.5.7. The vulnerability exists due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This security flaw enables unauthenticated attackers to modify stored SQL queries and database credentials used by the [show-dashboardbuilder] shortcode through forged requests, provided they can trick a site administrator into clicking a malicious link. When the shortcode is subsequently rendered on the front-end, the modified SQL query is executed, enabling arbitrary SQL injection and data exfiltration through publicly visible chart output.

Critical Impact

This vulnerability chains CSRF with SQL injection, allowing attackers to exfiltrate sensitive database contents through public-facing chart elements without authentication.

Affected Products

• DASHBOARD BUILDER – WordPress plugin for Charts and Graphs version 1.5.7 and earlier
• WordPress sites utilizing the [show-dashboardbuilder] shortcode functionality

Discovery Timeline

• 2026-01-14 - CVE-2025-14615 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-14615

Vulnerability Analysis

This vulnerability represents a dangerous chained attack where CSRF leads directly to SQL injection. The root issue lies in the settings handler within dashboardbuilder-admin.php at line 158, which processes form submissions without verifying a WordPress nonce token. Without this verification, the application cannot distinguish between legitimate administrator actions and forged requests from external origins.

The attack flow is particularly concerning because it combines two vulnerability classes: first, the CSRF allows modification of plugin settings without authorization, and second, those settings include a SQL query that gets executed when the shortcode renders on the front-end. This means an attacker who successfully exploits the CSRF can inject arbitrary SQL commands that will execute in the context of the WordPress database, potentially exposing sensitive user data, credentials, or other confidential information.

The vulnerability affects network-accessible WordPress installations and requires user interaction (clicking a malicious link), but does not require any prior authentication from the attacker. The impact includes high confidentiality risk through data exfiltration and low integrity impact through settings modification.

Root Cause

The fundamental cause of this vulnerability is the absence of nonce validation in the settings handler function located in dashboardbuilder-admin.php. WordPress provides the wp_verify_nonce() function specifically to prevent CSRF attacks, but the vulnerable code fails to implement this security control. When processing administrative settings changes, the plugin accepts form data without confirming the request originated from a legitimate WordPress admin page with a valid security token.

Additionally, the stored SQL query configured through these settings is executed without proper sanitization or parameterization when the [show-dashboardbuilder] shortcode is processed in dashboardbuilder.php, creating the secondary SQL injection vulnerability.

Attack Vector

The attack requires an attacker to craft a malicious web page or link containing a forged form submission targeting the vulnerable settings endpoint. When an authenticated WordPress administrator visits this malicious page, their browser automatically submits the forged request with their session cookies. The vulnerable plugin processes this request as legitimate, storing the attacker-controlled SQL query and potentially modified database credentials.

Subsequently, when any visitor accesses a page containing the [show-dashboardbuilder] shortcode, the malicious SQL query executes against the database. The query results are rendered within the chart output, allowing the attacker to exfiltrate data by simply viewing the public page or by examining the page source. This makes the attack particularly dangerous as data exfiltration occurs through normal page rendering rather than through error messages or timing attacks.

For technical details on the vulnerable code paths, see the plugin source code at line 158 of dashboardbuilder-admin.php and the shortcode handling in dashboardbuilder.php.

Detection Methods for CVE-2025-14615

Indicators of Compromise

• Unexpected modifications to Dashboard Builder plugin settings, particularly SQL query configurations
• Unusual database queries in MySQL/MariaDB logs originating from WordPress front-end page loads
• Dashboard Builder shortcode output displaying unexpected or sensitive data
• HTTP POST requests to Dashboard Builder admin endpoints from external referrers

Detection Strategies

• Monitor WordPress options table for unauthorized changes to Dashboard Builder configuration values
• Implement web application firewall rules to detect CSRF attacks targeting WordPress plugin endpoints
• Review Apache/Nginx access logs for suspicious referrer headers on plugin administration requests
• Enable database query logging and alert on queries containing UNION SELECT or other SQL injection patterns from WordPress context

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor WordPress directory file changes and database connection patterns
• Set up alerts for unexpected outbound data transfers from WordPress database servers
• Monitor for cross-origin requests to WordPress admin-ajax.php and plugin admin endpoints
• Implement Content Security Policy headers to limit form submission destinations

How to Mitigate CVE-2025-14615

Immediate Actions Required

• Update the DASHBOARD BUILDER – WordPress plugin for Charts and Graphs to a version newer than 1.5.7 if available
• Temporarily disable the Dashboard Builder plugin until a patched version is released
• Remove or disable all instances of the [show-dashboardbuilder] shortcode from public-facing pages
• Review Dashboard Builder plugin settings for unauthorized modifications and reset database credentials if compromise is suspected

Patch Information

Users should monitor the Wordfence vulnerability report for updates on patch availability. The vulnerability affects version 1.5.7 and all prior versions. Verify plugin updates through the official WordPress plugin repository and confirm nonce validation has been implemented before re-enabling the plugin.

Workarounds

• Implement a Web Application Firewall (WAF) rule to require valid referrer headers for Dashboard Builder admin requests
• Restrict access to WordPress admin pages using IP allowlisting or VPN requirements
• Use a security plugin to add CSRF protection at the application level for unprotected endpoints
• Consider isolating the WordPress database with read-only credentials for front-end queries

# Configuration example: Block external referrers to plugin admin endpoint (Apache)
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} dashboardbuilder-admin\.php [NC]
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule .* - [F,L]
</IfModule>