CVE-2025-25103: Indeed API (indeed-api) CSRF Vulnerability

CVE-2025-25103 Overview

CVE-2025-25103 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the indeed-api WordPress plugin developed by bnielsen. The flaw impacts all versions up to and including 0.5. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

An attacker can trick an authenticated administrator into submitting a forged request that changes plugin settings without consent. Exploitation requires user interaction, typically by luring the victim to a malicious page. The issue is documented in the Patchstack WordPress Plugin Advisory.

Critical Impact
Successful exploitation allows unauthorized modification of plugin settings on affected WordPress sites when an authenticated administrator visits an attacker-controlled page.

Affected Products

bnielsen Indeed API WordPress plugin (indeed-api)
All versions from initial release through 0.5
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-02-07 - CVE-2025-25103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25103

Vulnerability Analysis

The indeed-api plugin fails to validate the origin of state-changing HTTP requests. Administrative actions that modify plugin settings do not verify a WordPress nonce or equivalent anti-CSRF token. An attacker who convinces an authenticated administrator to visit a crafted page can force the browser to issue authenticated requests to the target site.

The request executes with the administrator's session credentials because browsers automatically attach cookies to same-origin requests. The plugin processes the forged request as legitimate and applies the attacker-controlled settings. The impact is limited to integrity of plugin configuration, with no direct confidentiality or availability effect indicated by the CVSS metrics.

Root Cause

The root cause is missing CSRF protection [CWE-352] on settings-change endpoints in the plugin. WordPress provides the wp_nonce_field() and check_admin_referer() primitives, but the affected code paths in indeed-api versions through 0.5 do not invoke these checks. Without a per-request token bound to the user session, the server cannot distinguish forged requests from intentional ones.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker crafts an HTML page containing a form or JavaScript that auto-submits a POST request to the vulnerable plugin endpoint on the target WordPress site. The attacker then delivers the link through phishing, forum posts, or malvertising.

When an authenticated administrator loads the page, the browser sends the request with the site's session cookies. The plugin accepts the request and updates settings without further validation. Details on the specific endpoint and parameters are documented in the Patchstack advisory.

Detection Methods for CVE-2025-25103

Indicators of Compromise

Unexpected changes to indeed-api plugin settings in the WordPress database (wp_options table).
HTTP POST requests to plugin administrative endpoints with Referer headers pointing to external domains.
Administrator sessions generating settings-change requests immediately after visiting external links.

Detection Strategies

Review web server access logs for POST requests to wp-admin endpoints associated with the indeed-api plugin that have missing or off-site Referer values.
Enable WordPress audit logging plugins to record configuration changes and correlate them with administrator browsing activity.
Compare current plugin settings against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Monitor for the presence of indeed-api plugin versions <= 0.5 across managed WordPress deployments.
Alert on outbound clicks from administrator workstations to unverified domains followed by admin-panel activity.
Track plugin option changes via database triggers or file integrity monitoring on WordPress installations.

How to Mitigate CVE-2025-25103

Immediate Actions Required

Deactivate the indeed-api plugin on WordPress sites where a patched version is not available.
Restrict WordPress administrator access to trusted browsers and dedicated management workstations.
Require administrators to log out of WordPress sessions when not actively performing management tasks.

Patch Information

At the time of publication, no fixed version beyond 0.5 is listed in the referenced advisory. Consult the Patchstack advisory for updated patch availability. Site owners should replace the plugin with a maintained alternative if no update is released.

Workarounds

Remove the indeed-api plugin directory from wp-content/plugins/ if the plugin is not business-critical.
Deploy a web application firewall (WAF) rule to block cross-origin POST requests to WordPress admin endpoints.
Enforce SameSite cookie attributes (SameSite=Lax or Strict) on WordPress session cookies to limit cross-site request delivery.

bash

# Example WAF rule fragment - block cross-origin POST to wp-admin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:1,deny,status:403,id:1002501,\
   msg:'Blocked cross-origin POST to wp-admin (CVE-2025-25103)'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" \
      "t:none"