CVE-2025-25149: Login-box CSRF Vulnerability

CVE-2025-25149 Overview

CVE-2025-25149 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Login-box plugin developed by Danillo Nunes. This vulnerability allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling malicious actors to inject persistent scripts into the application through forged requests. The vulnerability affects Login-box plugin versions up to and including 2.0.4.

Critical Impact

Attackers can exploit this CSRF vulnerability to inject malicious JavaScript code that persists in the application, potentially compromising administrator sessions, stealing credentials, or performing unauthorized actions on behalf of authenticated users.

Affected Products

• WordPress Login-box plugin versions through 2.0.4
• WordPress installations using the vulnerable Login-box plugin
• All users and administrators accessing sites with the affected plugin

Discovery Timeline

• 2025-02-07 - CVE-2025-25149 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-25149

Vulnerability Analysis

This vulnerability represents a chained attack scenario where Cross-Site Request Forgery (CWE-352) enables Stored Cross-Site Scripting. The Login-box plugin fails to implement proper CSRF token validation on form submissions that handle user-controllable content. Without adequate anti-CSRF protections, attackers can craft malicious requests that, when executed by an authenticated administrator, inject persistent malicious scripts into the plugin's stored data.

The attack chain requires social engineering to trick an authenticated WordPress administrator into visiting a malicious page or clicking a crafted link. Once the CSRF request is processed, the injected XSS payload persists in the database, executing whenever users interact with the affected Login-box component.

Root Cause

The root cause stems from insufficient CSRF protection mechanisms in the Login-box plugin's form handling functionality. The plugin does not properly validate WordPress nonces or implement other anti-CSRF tokens when processing input that gets stored in the database. This oversight allows external websites to submit forged requests on behalf of authenticated users, bypassing the same-origin policy protections that browsers typically enforce.

Attack Vector

The attack vector requires an attacker to craft a malicious web page containing a hidden form or JavaScript that automatically submits a request to the vulnerable WordPress endpoint. When an authenticated administrator visits this malicious page, the browser automatically includes their session cookies, causing the WordPress installation to process the forged request as legitimate. The payload submitted through this CSRF attack contains XSS content that gets stored in the database, creating a persistent threat that affects all subsequent visitors to pages using the Login-box functionality.

The exploitation workflow involves hosting a malicious page that triggers an automatic form submission to the vulnerable WordPress endpoint with XSS payloads embedded in the request parameters.

Detection Methods for CVE-2025-25149

Indicators of Compromise

• Unexpected JavaScript code appearing in Login-box plugin settings or stored content
• Suspicious form submissions in web server access logs targeting Login-box plugin endpoints
• Unusual administrative actions performed without corresponding user activity
• Reports of credential theft or session hijacking from site administrators

Detection Strategies

• Monitor WordPress access logs for POST requests to Login-box plugin endpoints originating from external referrers
• Implement Web Application Firewall (WAF) rules to detect CSRF patterns and XSS payloads in request parameters
• Review Login-box plugin database entries for suspicious script tags or JavaScript event handlers
• Enable browser Content Security Policy (CSP) headers to help detect and block injected scripts

Monitoring Recommendations

• Configure real-time alerting for changes to Login-box plugin configuration values
• Implement file integrity monitoring on WordPress plugin directories
• Deploy endpoint detection solutions capable of identifying malicious script execution in browser contexts
• Establish baseline activity patterns for administrative actions to identify anomalies

How to Mitigate CVE-2025-25149

Immediate Actions Required

• Update the Login-box plugin to a patched version when available from the developer
• Temporarily deactivate the Login-box plugin if no patch is available and the functionality is not critical
• Review stored Login-box content for any injected malicious scripts and remove them
• Audit administrative access logs for suspicious activity that may indicate prior exploitation

Patch Information

Organizations should monitor the Patchstack WordPress Vulnerability Database for updates regarding patched versions of the Login-box plugin. Until an official patch is released, implementing the workarounds below is strongly recommended.

Workarounds

• Restrict administrative access to trusted IP addresses using .htaccess or WordPress security plugins
• Implement additional CSRF protection through security plugins such as Wordfence or Sucuri
• Enable SameSite cookie attributes for WordPress session cookies to reduce CSRF attack surface
• Consider using a Web Application Firewall with virtual patching capabilities to block exploit attempts

# WordPress .htaccess restriction example for admin access
<Files wp-admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>