CVE-2025-23880: AMR Personalise CSRF Vulnerability

CVE-2025-23880 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the amr personalise WordPress plugin developed by anmari. This vulnerability allows attackers to trick authenticated administrators into performing unintended actions on behalf of the attacker, potentially leading to stored Cross-Site Scripting (XSS) attacks. The flaw exists because the plugin fails to properly validate request origins, enabling malicious actors to forge requests that bypass security controls.

Critical Impact

This CSRF vulnerability can be chained with stored XSS, allowing attackers to execute arbitrary JavaScript code in administrator browsers, potentially compromising the entire WordPress installation.

Affected Products

• amr personalise WordPress plugin versions up to and including 2.10
• WordPress installations using the vulnerable amr-personalise plugin

Discovery Timeline

• 2025-01-16 - CVE-2025-23880 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-23880

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The amr personalise plugin lacks proper CSRF token validation on sensitive administrative actions. When an authenticated administrator visits a malicious webpage while logged into their WordPress dashboard, the attacker can force the administrator's browser to submit requests to the plugin's administrative endpoints without proper authorization verification.

The vulnerability is particularly severe because it can be chained with stored XSS. An attacker can craft a malicious page that, when visited by an administrator, injects persistent JavaScript code into the WordPress site. This injected code would then execute in the browsers of all future visitors to affected pages, potentially leading to session hijacking, credential theft, or further malware distribution.

Root Cause

The root cause of this vulnerability lies in the absence of nonce verification on form submissions and AJAX requests within the amr personalise plugin. WordPress provides built-in CSRF protection mechanisms through nonces (number used once), but the plugin fails to implement these security checks on administrative functions. Without proper nonce validation, the plugin cannot distinguish between legitimate administrator requests and forged requests originating from attacker-controlled websites.

Attack Vector

The attack vector involves social engineering an authenticated WordPress administrator to visit a malicious webpage. The attacker's page contains hidden forms or JavaScript code that automatically submits requests to the vulnerable plugin endpoints using the administrator's active session. Since the plugin does not verify the origin of these requests, it processes them as legitimate, allowing the attacker to modify plugin settings or inject malicious content.

The attacker would typically host a webpage containing an auto-submitting form targeting the vulnerable plugin endpoints. When an administrator visits this page, the malicious payload is submitted to the WordPress site, resulting in stored XSS that persists in the database and affects all subsequent visitors.

Detection Methods for CVE-2025-23880

Indicators of Compromise

• Unexpected modifications to amr personalise plugin settings
• Presence of suspicious JavaScript code in plugin configuration or WordPress content
• Web server logs showing administrative plugin requests with unusual referrer headers
• Reports of XSS payloads executing on WordPress pages personalized by the plugin

Detection Strategies

• Monitor WordPress audit logs for changes to amr personalise plugin settings from unexpected IP addresses or at unusual times
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Use security plugins to scan for stored XSS payloads in database content
• Review HTTP referrer headers in web server logs for administrative POST requests to plugin endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress administrative actions and plugin modifications
• Configure alerts for bulk or rapid changes to plugin settings
• Implement file integrity monitoring on plugin configuration files
• Regularly audit WordPress database for malicious script injections

How to Mitigate CVE-2025-23880

Immediate Actions Required

• Update the amr personalise plugin to the latest available version that addresses this vulnerability
• Review recent changes to plugin settings and WordPress content for signs of unauthorized modifications
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attacks targeting WordPress administrative endpoints
• Ensure administrators use browser extensions or settings that prevent automatic form submissions

Patch Information

Review the Patchstack Vulnerability Report for the latest patch information and updated plugin versions. Administrators should update to a version higher than 2.10 when available, or consider alternative solutions if no patch has been released.

Workarounds

• Temporarily deactivate the amr personalise plugin until a patched version is available
• Implement strict Content Security Policy headers to mitigate the impact of potential XSS exploitation
• Use a WAF configured to validate and require CSRF tokens on all administrative POST requests
• Educate administrators about the risks of visiting untrusted websites while logged into WordPress

# WordPress plugin management - disable vulnerable plugin
wp plugin deactivate amr-personalise

# Verify plugin status
wp plugin list --name=amr-personalise --fields=name,status,version

# Scan for potential XSS payloads in WordPress content
wp db search "<script" --all-tables