CVE-2025-23800: OrangeBox CSRF Vulnerability

CVE-2025-23800 Overview

CVE-2025-23800 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the nova706 OrangeBox WordPress plugin. The flaw impacts all versions of OrangeBox up to and including 3.0.0. According to the Patchstack advisory, the CSRF condition can be chained to achieve stored Cross-Site Scripting (XSS), expanding the impact beyond a typical state-changing request forgery. The weakness is classified under [CWE-352] Cross-Site Request Forgery.

Critical Impact

Attackers can trick authenticated WordPress administrators into submitting forged requests that inject persistent JavaScript payloads into the site, leading to session theft, administrative action abuse, and site compromise.

Affected Products

• nova706 OrangeBox WordPress plugin (all versions through 3.0.0)
• WordPress sites with the OrangeBox plugin installed and activated
• Administrative users of vulnerable OrangeBox deployments

Discovery Timeline

• 2025-01-16 - CVE-2025-23800 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23800

Vulnerability Analysis

The OrangeBox plugin exposes administrative request handlers that do not validate request authenticity. The plugin omits or incorrectly verifies WordPress anti-CSRF nonces on state-changing endpoints. An attacker who lures an authenticated administrator to a malicious page can cause the browser to issue a forged request to the WordPress site. Because the Patchstack advisory describes a CSRF-to-stored-XSS chain, the forged request writes attacker-controlled input into persistent storage without proper sanitization. That stored payload then executes in the browser of any user who views the affected page.

The EPSS score of 0.078% suggests low observed exploitation probability, but the chained XSS impact raises the practical severity for WordPress operators.

Root Cause

The root cause is missing or insufficient CSRF protection on plugin endpoints that accept user-supplied data. WordPress provides wp_nonce_field() and check_admin_referer() to bind requests to a verified session, but the vulnerable OrangeBox code paths do not enforce these checks consistently. Output sanitization on the stored values is also insufficient, allowing the second-stage XSS payload to survive into the rendered DOM.

Attack Vector

The attack requires user interaction from a privileged WordPress user. An attacker hosts a malicious page containing a hidden form or fetch() call targeting the vulnerable OrangeBox endpoint. When an authenticated administrator visits the page, the browser submits the forged request using the administrator's session cookies. The injected payload is stored in the plugin's settings or content fields. Subsequent visits by administrators or site users execute the JavaScript in the context of the WordPress origin.

No verified public exploit code is available. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-23800

Indicators of Compromise

• Unexpected <script> tags, event handlers, or encoded JavaScript stored within OrangeBox plugin settings or post content
• WordPress administrator accounts performing OrangeBox configuration changes from unfamiliar Referer headers or external origins
• New or modified WordPress users, options, or plugin settings without a corresponding entry in administrator activity logs

Detection Strategies

• Audit the WordPress database for OrangeBox-related rows containing HTML or JavaScript patterns such as onerror=, onload=, javascript:, or <script
• Review web server access logs for POST requests to OrangeBox admin endpoints lacking a same-origin Referer header
• Correlate authenticated administrator sessions with outbound HTTP requests to recently visited third-party domains preceding configuration changes

Monitoring Recommendations

• Enable WordPress audit logging to capture all plugin settings changes with user, IP, and timestamp
• Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on admin pages
• Alert on creation of new administrative users or modification of high-privilege options following OrangeBox configuration writes

How to Mitigate CVE-2025-23800

Immediate Actions Required

• Deactivate and remove the OrangeBox plugin until a patched version above 3.0.0 is confirmed available
• Force a password reset and session invalidation for all WordPress administrator accounts
• Inspect existing OrangeBox-stored data and remove any injected HTML or JavaScript content

Patch Information

No fixed version is identified in the available CVE data. The Patchstack advisory lists all versions through 3.0.0 as vulnerable. Site operators should consult the Patchstack Vulnerability Report and the plugin maintainer's repository for an updated release before reinstalling.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce administrator exposure to malicious external pages
• Deploy a web application firewall rule that requires a same-origin Referer and valid nonce on OrangeBox admin POST endpoints
• Enforce a strict Content Security Policy that disallows inline scripts on WordPress administration pages
• Train administrators to log out of WordPress sessions when not actively managing the site

# Example nginx configuration enforcing Referer on wp-admin POST requests
location ~ ^/wp-admin/.*\.php$ {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_referer ~* "^https://your-wordpress-site\.example/") {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}