CVE-2025-23673: Email on Publish CSRF Vulnerability

CVE-2025-23673 Overview

CVE-2025-23673 is a Cross-Site Request Forgery (CSRF) vulnerability in the Email on Publish WordPress plugin developed by dkukral. The flaw affects all versions through 1.5 and chains CSRF with Stored Cross-Site Scripting (XSS) [CWE-352]. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the plugin's stored configuration. The injected payload then executes in the browser of any user who loads the affected administrative view.

Critical Impact
Successful exploitation allows attackers to persist malicious JavaScript in WordPress administrative contexts, enabling session theft, administrative action hijacking, and further site compromise.

Affected Products

WordPress Email on Publish plugin by dkukral
All versions from n/a through 1.5
WordPress sites with the plugin installed and an authenticated administrator

Discovery Timeline

2025-01-16 - CVE-2025-23673 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23673

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the Email on Publish plugin. First, plugin settings endpoints lack CSRF protection, accepting state-changing requests without validating an anti-CSRF nonce or verifying request origin. Second, user-supplied values written into plugin settings are not sanitized or escaped before being stored and later rendered in administrative pages. This combination allows an attacker who never authenticates to the target site to persist arbitrary JavaScript via an unsuspecting administrator's browser session.

The CWE classification [CWE-352] identifies the missing CSRF protection as the root weakness. The Stored XSS is the secondary impact that follows once the CSRF write succeeds. Because the payload is stored server-side, it executes for every administrator who subsequently loads the affected page, expanding the blast radius beyond a single victim.

Root Cause

The plugin's settings handler does not implement WordPress nonce validation through functions such as check_admin_referer() or wp_verify_nonce(). It also fails to apply output escaping with esc_attr(), esc_html(), or wp_kses() to fields rendered in the WordPress administrative interface.

Attack Vector

An attacker hosts a page containing a hidden form or fetch request targeting the plugin's settings endpoint on a vulnerable WordPress site. The payload includes a malicious script value for a plugin configuration field. When a logged-in administrator visits the attacker page, the browser submits the request with valid session cookies. The server accepts the request, stores the script payload, and later renders it unescaped in the administrative settings view, executing the attacker's JavaScript in the administrator context.

No verified public proof-of-concept code is available. See the Patchstack WordPress Vulnerability Report for further technical detail.

Detection Methods for CVE-2025-23673

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings present in Email on Publish plugin option values stored in the wp_options table.
Administrator browser sessions making unexpected outbound requests to unknown domains after loading WordPress admin pages.
Plugin settings changes recorded in audit logs without a corresponding administrator-initiated workflow.

Detection Strategies

Inspect wp_options rows associated with the email-on-publish plugin for HTML or JavaScript content that should not appear in configuration values.
Review web server access logs for POST requests to plugin administrative endpoints lacking a valid Referer header matching the WordPress site origin.
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests targeting /wp-admin/ endpoints related to the plugin.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record settings changes with user, timestamp, and source IP.
Monitor administrator browser endpoints for anomalous script execution and outbound connections initiated from /wp-admin/ pages.
Track plugin version inventory across managed WordPress sites to identify hosts still running Email on Publish1.5 or earlier.

How to Mitigate CVE-2025-23673

Immediate Actions Required

Deactivate the Email on Publish plugin on all WordPress sites until a patched version is confirmed available.
Audit plugin option values in the database and remove any unexpected HTML or JavaScript content from stored settings.
Rotate administrator credentials and invalidate active sessions if Stored XSS execution is suspected.

Patch Information

No fixed version has been published in the available CVE data. The advisory identifies all releases through 1.5 as affected. Monitor the Patchstack WordPress Vulnerability Report and the plugin's WordPress.org listing for an updated release.

Workarounds

Remove the plugin entirely if a maintained alternative is available for publish notification workflows.
Restrict /wp-admin/ access to known administrator IP addresses through web server or WAF rules to reduce CSRF exposure.
Require administrators to use separate browser profiles or sessions for WordPress administration to limit cross-site request risk.

bash

# Configuration example: restrict wp-admin access via nginx
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}