CVE-2025-23640: Rename Author Slug CSRF Vulnerability

CVE-2025-23640 Overview

CVE-2025-23640 is a Cross-Site Request Forgery (CSRF) vulnerability in the Nazmul Ahsan Rename Author Slug WordPress plugin that leads to Stored Cross-Site Scripting (XSS). The flaw affects Rename Author Slug versions up to and including 1.2.0. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, persists JavaScript payloads into the WordPress site. The vulnerability is tracked under [CWE-352] and exposes sites to session theft, administrative account takeover, and content tampering.

Critical Impact
Successful exploitation enables stored XSS in the administrative context, allowing attackers to execute arbitrary JavaScript in any user's browser that loads affected pages.

Affected Products

Nazmul Ahsan Rename Author Slug plugin for WordPress
All versions from n/a through 1.2.0
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-16 - CVE-2025-23640 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23640

Vulnerability Analysis

The Rename Author Slug plugin lets WordPress administrators modify author URL slugs. The plugin's state-changing endpoint does not validate request authenticity using a nonce or equivalent anti-CSRF token. An attacker who lures an authenticated administrator into visiting a crafted page can force the browser to submit a request that updates the author slug with attacker-controlled content. Because input is stored without proper sanitization or output encoding, JavaScript supplied through the forged request persists in the database and executes when affected pages render.

The attack chain combines two weaknesses: missing CSRF protection on the slug update handler and inadequate sanitization of the slug value. The result is a stored XSS payload deliverable without direct authentication, requiring only that a logged-in administrator interact with the attacker's content.

Root Cause

The root cause is the absence of CSRF token verification on plugin form submissions, compounded by insufficient validation of the author slug input field. WordPress provides wp_nonce_field() and check_admin_referer() for this purpose, but the affected plugin versions do not enforce these checks on the relevant request handler.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. When a logged-in administrator visits the page, the browser submits the request with valid session cookies. The malicious payload is stored and later executed in the context of any user viewing the affected author profile.

No exploitation code example is published. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-23640

Indicators of Compromise

Unexpected modifications to author slug fields in the WordPress wp_usermeta or wp_users tables
Author slug values containing HTML tags, JavaScript keywords, or URL-encoded script payloads
Outbound requests from administrator browsers to unfamiliar domains after visiting external pages
Web server access logs showing POST requests to the plugin's slug update endpoint originating from external Referer headers

Detection Strategies

Audit installed WordPress plugins and flag any instance of Rename Author Slug at version 1.2.0 or earlier
Query the WordPress database for author slug values containing characters such as <, >, ", or script
Inspect HTTP request logs for cross-origin POST submissions targeting plugin administrative URLs without valid nonce parameters

Monitoring Recommendations

Enable web application firewall rules that block requests missing valid WordPress nonce tokens on plugin endpoints
Monitor administrator session activity for anomalous form submissions following external link clicks
Alert on database writes to user profile fields containing script-like content

How to Mitigate CVE-2025-23640

Immediate Actions Required

Update the Rename Author Slug plugin to a version newer than 1.2.0 once the vendor releases a fix
Deactivate and remove the plugin if a patched version is not available
Review all author slug values in the database and sanitize any containing suspicious content
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

The vendor has not published a confirmed fixed version in the referenced advisory at the time of NVD publication. Site operators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release.

Workarounds

Remove the Rename Author Slug plugin until a patched version is published
Restrict administrative access to trusted IP addresses through web server or WAF rules
Require administrators to use separate browser profiles or sessions for WordPress administration
Deploy a WAF policy that enforces same-origin Referer or Origin headers on plugin POST endpoints

bash

# Example WAF rule to require same-origin Referer on plugin endpoints
SecRule REQUEST_URI "@contains /wp-admin/" \
  "chain,deny,status:403,id:1002301,msg:'Block cross-origin POST to wp-admin'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com/"