CVE-2025-14616: Recooty Job Widget WordPress CSRF Flaw

CVE-2025-14616 Overview

The Recooty – Job Widget (Old Dashboard) plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.0.6. This vulnerability stems from missing nonce validation on the recooty_save_maybe() function, which allows unauthenticated attackers to manipulate the recooty_key option and inject malicious content into iframe src attributes. Successful exploitation requires social engineering to trick a site administrator into clicking a malicious link.

Critical Impact

Unauthenticated attackers can modify WordPress plugin settings and inject malicious content into iframe elements, potentially leading to phishing attacks or malicious content delivery to site visitors.

Affected Products

• Recooty – Job Widget (Old Dashboard) plugin for WordPress version 1.0.6 and earlier
• WordPress sites using the Recooty plugin for job listings
• All WordPress installations with vulnerable Recooty plugin versions

Discovery Timeline

• 2026-01-28 - CVE CVE-2025-14616 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-14616

Vulnerability Analysis

This vulnerability is classified as Cross-Site Request Forgery (CWE-352), a web application security flaw that allows attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability exists because the recooty_save_maybe() function fails to implement proper nonce validation, a critical security mechanism in WordPress that prevents CSRF attacks.

When an administrator visits a malicious page while authenticated to WordPress, the attacker can forge requests that modify plugin settings. The attack specifically targets the recooty_key option, which controls how the plugin generates iframe content for job widget displays. By manipulating this value, attackers can inject arbitrary URLs or malicious content into the iframe src attributes rendered on the victim's WordPress site.

The exploitation requires user interaction—specifically, an authenticated administrator must click a malicious link or visit a compromised page. This social engineering component limits the attack surface but does not eliminate the risk, particularly in targeted attacks against specific WordPress installations.

Root Cause

The root cause is the absence of WordPress nonce verification in the recooty_save_maybe() function. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to prevent CSRF attacks by ensuring form submissions originate from legitimate WordPress admin pages. The vulnerable function processes option updates without verifying that the request includes a valid, unexpired nonce token, allowing forged cross-origin requests to be processed as legitimate.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious HTML page containing a hidden form that targets the vulnerable WordPress plugin endpoint. This form includes parameters to modify the recooty_key setting to an attacker-controlled value. When an authenticated WordPress administrator visits the attacker's page, JavaScript automatically submits the form, or the victim is tricked into clicking a disguised button. The browser sends the request along with the administrator's session cookies, and the vulnerable plugin processes the request without validating its origin, resulting in unauthorized modification of plugin settings.

The injected content then appears in iframe elements on the WordPress site, potentially redirecting visitors to phishing pages or delivering malicious payloads. For technical details on the vulnerable code paths, refer to the WordPress Recooty Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14616

Indicators of Compromise

• Unexpected changes to the recooty_key option in the WordPress database (wp_options table)
• Suspicious iframe src attributes in page source code pointing to unknown or malicious domains
• Administrator account activity logs showing settings changes without corresponding admin panel access
• Referrer logs showing plugin configuration endpoints accessed from external domains

Detection Strategies

• Monitor WordPress option changes in the database, specifically tracking modifications to recooty_key and related Recooty plugin settings
• Implement web application firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugin endpoints
• Review server access logs for POST requests to Recooty plugin administrative functions from suspicious referrers
• Deploy Content Security Policy (CSP) headers to detect and block unauthorized iframe content injection

Monitoring Recommendations

• Enable WordPress audit logging to track all option changes with timestamps and user context
• Configure alerts for iframe src modifications in plugin-generated content
• Implement regular integrity checks on WordPress plugin configuration values
• Monitor for unusual cross-origin requests to WordPress administrative endpoints

How to Mitigate CVE-2025-14616

Immediate Actions Required

• Temporarily disable the Recooty – Job Widget (Old Dashboard) plugin until a patched version is available
• Review and verify the current recooty_key option value in the WordPress database for unauthorized modifications
• Audit WordPress administrative activity logs for suspicious settings changes
• Implement additional CSRF protection at the web server or WAF level for plugin endpoints

Patch Information

Organizations should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates regarding a patched version of the Recooty – Job Widget plugin. The fix should include proper nonce validation using WordPress's built-in wp_verify_nonce() function in the recooty_save_maybe() function.

Workarounds

• Deactivate and remove the Recooty – Job Widget plugin if not critical to site operations
• Implement a Web Application Firewall rule to block POST requests to the vulnerable endpoint from external referrers
• Use WordPress security plugins that provide additional CSRF protection layers
• Restrict administrative access to trusted IP addresses to limit the attack surface

# Configuration example
# WordPress .htaccess rule to restrict admin access by IP
<Files "admin-post.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>

# Alternative: Block external referrers from accessing plugin endpoints
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https://your-domain\.com [NC]
RewriteCond %{REQUEST_URI} ^/wp-admin/.*recooty.* [NC]
RewriteRule ^ - [F,L]