CVE-2025-24713: Button Generator Plugin CSRF Vulnerability

CVE-2025-24713 Overview

CVE-2025-24713 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Wow-Company Button Generator – easily Button Builder plugin for WordPress. The flaw exists in versions up to and including 3.1.1. The issue is tracked under CWE-352: Cross-Site Request Forgery.

An attacker can craft a malicious web page that triggers unauthorized state-changing actions in the plugin when an authenticated WordPress user visits the page. Exploitation requires user interaction, such as clicking a link or loading attacker-controlled content.

Critical Impact
Successful exploitation allows attackers to perform unauthorized button-generation actions on behalf of authenticated WordPress users, resulting in limited integrity and availability impact on affected sites.

Affected Products

Wow-Company Button Generator – easily Button Builder plugin for WordPress
Versions from n/a through <= 3.1.1
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-24 - CVE CVE-2025-24713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24713

Vulnerability Analysis

The Button Generator plugin fails to validate the origin of state-changing HTTP requests. WordPress plugins are expected to protect sensitive actions using nonces generated with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). The affected plugin does not enforce this validation on button-generation endpoints.

An attacker can craft an HTML page containing a form or JavaScript that submits requests to the vulnerable WordPress endpoint. When an authenticated administrator or privileged user visits the attacker-controlled page, the browser automatically includes the session cookie, and the plugin executes the requested action without verifying user intent.

Root Cause

The root cause is missing anti-CSRF token verification on button-generation actions within the plugin. Any function that accepts POST or GET parameters to modify plugin state must validate a nonce tied to the current user session. Without this check, the server cannot distinguish between legitimate administrator actions and requests forged by third-party origins.

Attack Vector

Exploitation occurs over the network and requires user interaction from an authenticated victim. The attacker hosts a malicious page or injects a payload into a resource loaded by the target browser. When the victim visits the page while logged into the WordPress admin panel, the browser issues an authenticated request to the vulnerable endpoint. The plugin processes the request as if it were legitimate. Refer to the Patchstack WordPress Vulnerability advisory for additional technical details.

Detection Methods for CVE-2025-24713

Indicators of Compromise

Unexpected creation, modification, or deletion of button entries within the Button Generator plugin configuration.
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
Administrator sessions generating plugin state changes immediately after visiting external URLs.

Detection Strategies

Review WordPress audit logs for plugin configuration changes correlated with administrator browsing activity.
Inspect HTTP request logs for state-changing requests to Button Generator endpoints that lack a valid _wpnonce parameter.
Monitor for anomalous Referer header values on privileged plugin actions.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture administrator actions and plugin configuration changes.
Forward web server access logs to a centralized SIEM for correlation and long-term retention.
Alert on privileged WordPress actions initiated from cross-origin referers or without expected nonce parameters.

How to Mitigate CVE-2025-24713

Immediate Actions Required

Update the Button Generator – easily Button Builder plugin to a version later than 3.1.1 once a fixed release is available from the vendor.
Deactivate and remove the plugin if a patched version is not yet published and the functionality is not required.
Instruct WordPress administrators to log out of the admin panel when browsing untrusted sites.

Patch Information

Monitor the Patchstack advisory and the plugin's WordPress.org listing for a security release addressing versions <= 3.1.1. Apply the vendor-supplied patch as soon as it is available.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to Button Generator plugin endpoints.
Restrict WordPress administrator access using IP allowlists on the /wp-admin/ path.
Enforce SameSite=Strict or SameSite=Lax on WordPress session cookies to reduce CSRF exposure from third-party origins.

bash

# Example nginx configuration restricting wp-admin by source IP
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}