CVE-2025-23720: Web Push CSRF Vulnerability

CVE-2025-23720 Overview

CVE-2025-23720 is a Cross-Site Request Forgery (CSRF) vulnerability in the Marco Castelluccio Web Push plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.4.0. Attackers can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) primitive, allowing malicious JavaScript to be persisted by the plugin when an authenticated administrator is tricked into submitting a forged request.

The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. It is exploitable over the network and requires user interaction, typically through a crafted link or attacker-controlled page.

Critical Impact
A successful exploit results in stored JavaScript executing in administrator browsers, enabling session theft, privilege abuse, and persistent site compromise.

Affected Products

Marco Castelluccio Web Push plugin for WordPress, versions up to and including 1.4.0
WordPress installations with the Web Push plugin activated
Sites where administrators may visit attacker-controlled pages while authenticated

Discovery Timeline

2025-01-16 - CVE-2025-23720 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23720

Vulnerability Analysis

The Web Push plugin exposes administrative actions that do not properly validate the origin of incoming requests. The plugin fails to verify a WordPress nonce or equivalent anti-CSRF token before processing state-changing requests. As a result, an authenticated administrator visiting an attacker-controlled page can have a forged HTTP request submitted to the WordPress backend on their behalf.

The plugin also fails to sanitize input fields that get persisted to the WordPress database. When the forged request injects JavaScript payloads into plugin settings, the content is stored without encoding. The payload then executes whenever a user loads the affected administrative or front-end page, producing a Stored XSS condition (CWE-79 in combination with the primary CWE-352).

The scope-changed nature of the issue allows the injected script to access resources outside the vulnerable component, including the administrator session context. This raises the practical impact beyond a simple reflected XSS.

Root Cause

The root cause is the absence of CSRF protection on administrative endpoints in the Web Push plugin through version 1.4.0. WordPress provides wp_nonce_field() and check_admin_referer() helpers for this purpose, but the affected handlers do not invoke them. Combined with missing output encoding on stored values, this creates the CSRF-to-Stored-XSS chain.

Attack Vector

Exploitation proceeds in three stages. First, an attacker hosts a webpage containing an auto-submitting HTML form or JavaScript that targets the vulnerable plugin endpoint. Second, the attacker lures an authenticated WordPress administrator to visit the page, often through phishing or watering-hole techniques. Third, the victim's browser submits the request with valid session cookies, causing the plugin to store the attacker's JavaScript payload. The payload then executes for any user who loads the affected page.

The vulnerability mechanism is documented in the Patchstack advisory for the Web Push plugin. No public proof-of-concept code has been released.

Detection Methods for CVE-2025-23720

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URIs persisted within Web Push plugin settings in the wp_options table
WordPress administrator sessions producing outbound requests to unfamiliar domains shortly after visiting external links
New or modified WordPress administrator accounts created without a corresponding admin-initiated workflow
Web server access logs showing POST requests to Web Push plugin endpoints with Referer headers from external, untrusted domains

Detection Strategies

Inspect plugin configuration values stored in the database for HTML or JavaScript content that should be plain text
Review WordPress audit logs for plugin setting changes that occurred without a matching administrator login from a trusted IP
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on admin pages
Scan rendered pages for unexpected script sources that do not match the site's known asset baseline

Monitoring Recommendations

Enable WordPress activity logging plugins to capture option changes and settings updates
Forward web server logs to a centralized analytics platform and alert on POST requests to plugin endpoints with foreign Referer headers
Track administrator account creation, role changes, and password resets in near real time
Periodically diff plugin settings against a known-good baseline to surface unauthorized modifications

How to Mitigate CVE-2025-23720

Immediate Actions Required

Deactivate the Web Push plugin on any WordPress site running version 1.4.0 or earlier until a patched release is available
Audit plugin settings and stored content for injected scripts and remove any malicious payloads
Force password resets for all WordPress administrator accounts and invalidate active sessions
Restrict WordPress administrative access to known IP ranges through web server or WAF rules

Patch Information

No fixed version is identified in the current advisory. The vulnerability affects Web Push through version 1.4.0. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release that introduces nonce verification and input sanitization.

Workarounds

Remove or replace the Web Push plugin with an actively maintained alternative that enforces WordPress nonces
Deploy a Web Application Firewall rule that requires a valid Referer or Origin header matching the site domain for POST requests to plugin endpoints
Apply a strict Content Security Policy that disallows inline scripts on administrative pages to limit Stored XSS impact
Train administrators to log out of WordPress before browsing external links and to use a dedicated browser profile for site management

bash

# Example NGINX rule to block cross-origin POSTs to the plugin endpoint
location ~* /wp-admin/admin\.php {
    if ($request_method = POST) {
        if ($http_origin !~* "^https?://(www\.)?example\.com$") {
            return 403;
        }
    }
}