CVE-2025-23972: Contact Form 7 reCAPTCHA CSRF Vulnerability

CVE-2025-23972 Overview

CVE-2025-23972 is a Cross-Site Request Forgery (CSRF) vulnerability in the Brian S. Reed Contact Form 7 reCAPTCHA WordPress plugin. The flaw affects all versions up to and including 1.2.0. An attacker can trick an authenticated administrator into submitting a forged request that changes plugin state without their consent. The issue is tracked under CWE-352 and requires user interaction to succeed.

Critical Impact
A successful CSRF attack allows an unauthenticated attacker to alter plugin settings when a logged-in administrator visits a malicious page, undermining the integrity of the reCAPTCHA protection layer on contact forms.

Affected Products

Brian S. Reed Contact Form 7 reCAPTCHA plugin for WordPress
All versions from n/a through 1.2.0
WordPress sites using contact-form-7-recaptcha as an anti-spam integration

Discovery Timeline

2025-07-04 - CVE-2025-23972 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23972

Vulnerability Analysis

The Contact Form 7 reCAPTCHA plugin exposes one or more state-changing actions without adequate CSRF protection. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) that plugins must use to bind a request to an authenticated user session. When these checks are missing or improperly validated, any origin can construct a request that the victim's browser will submit with valid session cookies.

The vulnerability requires user interaction, meaning the attacker must lure an authenticated administrator to a crafted page or link. Once triggered, the forged request executes in the administrator's session context. The impact is limited to integrity, with no direct confidentiality or availability effect according to the CVSS metrics.

Root Cause

The root cause is missing or improper CSRF token validation on sensitive plugin endpoints. WordPress plugins that update options, toggle features, or modify reCAPTCHA site keys must verify a nonce tied to the current user session. Without this check, the plugin trusts any request bearing valid authentication cookies, regardless of origin.

Attack Vector

Exploitation proceeds through the network vector with low attack complexity. An attacker hosts a page containing an auto-submitting HTML form or image tag targeting the vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator loads the attacker-controlled page, the browser attaches session cookies and issues the request. The plugin processes the request as legitimate and applies the attacker-supplied configuration change. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23972

Indicators of Compromise

Unexpected changes to Contact Form 7 reCAPTCHA plugin settings, such as modified site or secret keys.
WordPress access logs showing POST requests to plugin admin endpoints with Referer headers pointing to external domains.
Administrator sessions performing configuration changes shortly after visiting untrusted external links.

Detection Strategies

Monitor WordPress audit logs for plugin option updates that lack a preceding admin dashboard navigation event.
Inspect HTTP request headers for missing or mismatched Referer and Origin values on plugin administrative actions.
Compare current plugin configuration against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Enable a WordPress activity logging plugin to track option changes and administrator actions with timestamps.
Forward web server access logs to a centralized log platform and alert on cross-origin POST requests to /wp-admin/.
Review outbound reCAPTCHA verification failures, which may indicate that attacker-controlled keys were injected.

How to Mitigate CVE-2025-23972

Immediate Actions Required

Deactivate the Contact Form 7 reCAPTCHA plugin until a fixed version is available or replace it with a maintained alternative.
Audit current plugin settings and reset the reCAPTCHA site and secret keys to values known to be legitimate.
Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to use separate browsers or profiles for administrative work.

Patch Information

At the time of publication, no fixed version has been identified in the referenced advisory. The vulnerability affects all releases through 1.2.0. Site owners should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for updates.

Workarounds

Place the WordPress admin area behind an additional authentication layer such as HTTP basic authentication or IP allowlisting.
Deploy a web application firewall rule that enforces same-origin Referer and Origin headers on /wp-admin/ POST requests.
Replace the vulnerable plugin with an actively maintained reCAPTCHA integration for Contact Form 7.

bash

# Example nginx rule to block cross-origin POSTs to wp-admin
location ^~ /wp-admin/ {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_origin ~* ^https?://(www\.)?example\.com$) {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
}