CVE-2025-23793 Overview
CVE-2025-23793 is a Cross-Site Request Forgery (CSRF) vulnerability in the Auto FTP WordPress plugin by Ciprian Turcu. The flaw affects all versions up to and including 1.0.1. Successful exploitation chains the CSRF weakness with Stored Cross-Site Scripting (XSS), enabling attackers to persist malicious JavaScript in the WordPress instance. The vulnerability is tracked under [CWE-352] and requires user interaction from an authenticated administrator who visits an attacker-controlled page. Because the payload is stored, it executes against every subsequent visitor to the affected admin context.
Critical Impact
Attackers can persist arbitrary JavaScript in the WordPress administrative interface by tricking a logged-in administrator into loading a crafted request, leading to session theft, privilege abuse, and further site compromise.
Affected Products
- Ciprian Turcu Auto FTP plugin for WordPress
- All versions through 1.0.1
- WordPress installations with the Auto FTP plugin enabled
Discovery Timeline
- 2025-01-16 - CVE-2025-23793 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23793
Vulnerability Analysis
The Auto FTP plugin exposes plugin configuration endpoints without sufficient CSRF protection. State-changing requests do not validate a WordPress nonce or other anti-CSRF token tied to the requesting user session. When an authenticated administrator loads an attacker-controlled page, the browser submits a forged request to the plugin endpoint with the administrator's credentials. The plugin processes the request and stores attacker-supplied input in the database without proper output encoding, producing a Stored XSS condition. The chained outcome converts a passive social engineering vector into persistent script execution inside the WordPress admin panel.
Root Cause
The root cause is missing CSRF validation [CWE-352] on plugin handlers that accept and persist user-controlled values. The plugin neither verifies a nonce via wp_verify_nonce() nor enforces strict request origin checks. A secondary defect is insufficient sanitization of stored input and missing output encoding when rendering values back into administrative views.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or scripted request targeting the vulnerable Auto FTP endpoint. A logged-in WordPress administrator who visits the page issues the forged request, writing a malicious payload such as a <script> tag into plugin settings. The stored payload then executes whenever an administrator loads the affected plugin page, allowing cookie theft, session hijacking, account creation, or pivoting to remote code execution through WordPress administrative functions.
No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-23793
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes stored in Auto FTP plugin configuration rows within the WordPress database.
- Administrator browser sessions issuing outbound requests to unknown domains shortly after visiting plugin settings pages.
- New or modified WordPress administrator accounts created without a corresponding authenticated admin action.
Detection Strategies
- Inspect the wp_options table and Auto FTP plugin tables for HTML or JavaScript content in fields expected to hold plaintext configuration values.
- Review web server access logs for POST requests to Auto FTP endpoints lacking a valid Referer header or originating from external domains.
- Audit WordPress activity logs for plugin configuration changes that do not align with known administrator activity windows.
Monitoring Recommendations
- Enable a web application firewall rule set that flags cross-origin POST requests to /wp-admin/ endpoints.
- Monitor for Content Security Policy (CSP) violation reports from administrator sessions on affected sites.
- Alert on creation of new administrator accounts or changes to user roles immediately after plugin setting modifications.
How to Mitigate CVE-2025-23793
Immediate Actions Required
- Deactivate and remove the Auto FTP plugin from any WordPress installation running version 1.0.1 or earlier until a patched release is confirmed.
- Audit plugin configuration data for injected script content and remove any unauthorized entries.
- Force a password reset and session invalidation for all WordPress administrator accounts on affected sites.
Patch Information
No vendor patch is currently referenced in the NVD entry. The advisory lists the vulnerability as affecting all versions up to and including 1.0.1. Administrators should consult the Patchstack Vulnerability Report for the latest remediation status and replace the plugin with a maintained alternative if no fix becomes available.
Workarounds
- Remove the Auto FTP plugin and adopt an actively maintained FTP integration plugin that enforces WordPress nonce validation.
- Restrict WordPress administrative access by IP allowlisting at the web server or WAF layer to reduce CSRF exposure.
- Train administrators to avoid browsing untrusted sites while authenticated to the WordPress admin panel and to use a separate browser profile for administrative tasks.
# Configuration example: disable the Auto FTP plugin via WP-CLI
wp plugin deactivate auto-ftp
wp plugin delete auto-ftp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
