CVE-2025-14795: Stop Spammers Classic CSRF Vulnerability

CVE-2025-14795 Overview

CVE-2025-14795 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Stop Spammers Classic plugin for WordPress. The flaw exists in all versions up to and including 2026.1 and stems from missing nonce validation in the ss_addtoallowlist class. Unauthenticated attackers can add arbitrary email addresses to the spam allowlist by tricking a site administrator into clicking a crafted link. The issue is classified as [CWE-352] and requires user interaction to succeed. The vendor released a partial patch in version 2026.1.

Critical Impact
Successful exploitation lets attackers manipulate the plugin's allowlist, bypassing anti-spam controls and enabling spam or malicious senders to reach a WordPress site.

Affected Products

Stop Spammers Classic plugin for WordPress (all versions through 2026.1)
WordPress sites running the vulnerable plugin with administrator sessions
Installations relying on the plugin's allowlist for spam filtering

Discovery Timeline

2026-01-28 - CVE-2025-14795 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14795

Vulnerability Analysis

The Stop Spammers Classic plugin exposes an action handler in the ss_addtoallowlist class that adds email addresses to the plugin's spam allowlist. The handler processes incoming requests without verifying a WordPress nonce token. Without nonce validation, the plugin cannot confirm that a request originated from a legitimate administrator-driven action inside the WordPress dashboard.

An attacker hosts a malicious page or sends a crafted link to a logged-in administrator. When the administrator visits the page, the browser submits an authenticated request to the WordPress site using existing session cookies. The plugin treats the request as legitimate and writes the attacker-supplied email address into the allowlist. The impact is limited to integrity of the spam filter, not confidentiality or availability, which aligns with the vulnerability's scoring profile.

Root Cause

The root cause is missing CSRF protection in ss_addtoallowlist.php. WordPress provides wp_verify_nonce() and check_admin_referer() helpers for state-changing actions, but the vulnerable handler does not invoke them. As a result, the plugin relies solely on the administrator's authenticated session, which a forged cross-origin request can leverage.

Attack Vector

Exploitation requires social engineering. The attacker must convince an authenticated administrator to load attacker-controlled content while signed into WordPress. The forged request then writes an arbitrary email to the allowlist. The vulnerability mechanism is documented in the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14795

Indicators of Compromise

Unexpected email addresses appearing in the Stop Spammers Classic allowlist configuration
Administrator HTTP requests to plugin endpoints with Referer headers pointing to external or unknown domains
Inbound spam or phishing messages from senders that were previously blocked
Web server access logs showing POST or GET requests targeting ss_addtoallowlist handlers without corresponding admin dashboard navigation

Detection Strategies

Monitor WordPress audit logs for allowlist modifications and correlate them with administrator session activity
Inspect web server logs for state-changing plugin requests that lack a same-origin Referer header
Review plugin configuration files and database tables for allowlist entries that were not added by site staff
Compare plugin version against 2026.1 across all managed WordPress instances

Monitoring Recommendations

Enable verbose logging on the WordPress admin interface to capture configuration changes
Forward WordPress and web server logs to a centralized analytics platform for correlation
Alert on outbound HTTP requests from administrator browsers to unrecognized domains during active admin sessions
Track plugin update status and configuration drift across the WordPress fleet

How to Mitigate CVE-2025-14795

Immediate Actions Required

Update Stop Spammers Classic to version 2026.1, which contains the partial patch, and monitor the vendor for a complete fix
Audit the plugin allowlist and remove any email addresses that cannot be attributed to a legitimate administrator action
Require administrators to log out of WordPress sessions when not actively performing maintenance
Restrict WordPress admin access by IP allowlist or VPN where operationally feasible

Patch Information

The vendor applied a partial patch in version 2026.1 of Stop Spammers Classic. Patch details are tracked in WordPress Changeset #3436357 and WordPress Changeset #3440788. Administrators should verify they are running the patched release and continue to monitor the plugin repository for follow-up updates that fully address the issue.

Workarounds

Temporarily deactivate the Stop Spammers Classic plugin if the patched version cannot be deployed
Deploy a web application firewall rule that blocks requests to the plugin's allowlist handlers without a valid nonce or same-origin Referer
Use browser session isolation so administrators do not browse untrusted sites while authenticated to WordPress
Enforce least privilege by limiting the number of accounts with administrator capabilities

bash

# Example WAF rule (ModSecurity) blocking off-origin requests to the vulnerable handler
SecRule REQUEST_URI "@contains ss_addtoallowlist" \
  "id:1014795,phase:1,deny,status:403,\
   chain,msg:'Block CSRF against Stop Spammers Classic (CVE-2025-14795)'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/" "t:none"