CVE-2025-25152: Smart DoFollow CSRF Vulnerability

CVE-2025-25152 Overview

CVE-2025-25152 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Smart DoFollow WordPress plugin by LukaszWiecek. The flaw affects all versions up to and including 1.0.2. Attackers can chain the CSRF weakness to deliver Stored Cross-Site Scripting (XSS) payloads into the plugin's persistent settings.

Exploitation requires a logged-in administrator to visit an attacker-controlled page. Once triggered, the request injects malicious JavaScript that executes in the browser of any user who later loads the affected WordPress pages.

Critical Impact
A successful attack stores attacker-controlled JavaScript inside the WordPress site, enabling session theft, administrative account takeover, and persistent client-side compromise of visitors.

Affected Products

Smart DoFollow WordPress plugin (smart-dofollow) by LukaszWiecek
Versions from n/a through 1.0.2 inclusive
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-02-07 - CVE-2025-25152 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25152

Vulnerability Analysis

The Smart DoFollow plugin exposes administrative actions that update plugin settings without validating the origin of the request. The plugin does not implement a WordPress nonce check or equivalent anti-CSRF token on state-changing endpoints. As a result, an attacker can craft a malicious HTML form or image tag that submits a forged settings update on behalf of an authenticated administrator.

The forged request writes attacker-supplied input into plugin configuration storage. Because the stored value is later rendered in the WordPress front-end or admin context without proper output encoding, the injected payload executes as JavaScript. This converts the CSRF primitive into a Stored XSS condition with persistent impact.

The attack requires user interaction (UI:R) but no authentication on the attacker side, and the scope changes (S:C) because the injected script executes in the browser context of other users.

Root Cause

The root cause is the absence of CSRF protection on settings-handling routes. WordPress provides wp_nonce_field() and check_admin_referer() primitives specifically to prevent this class of issue, and the affected plugin versions do not invoke them. The secondary defect is missing output sanitization or escaping when rendering stored configuration values, which permits the XSS chain.

Attack Vector

The attack is network-reachable and proceeds in three stages. First, the attacker hosts a page containing an auto-submitting form targeting the plugin's settings endpoint. Second, an authenticated WordPress administrator visits that page while logged in, causing the browser to send authenticated cookies with the forged request. Third, the malicious payload is stored in the plugin configuration and executed when rendered in subsequent page loads.

The vulnerability mechanism is described in the Patchstack WordPress Vulnerability advisory. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2025-25152

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes stored in Smart DoFollow plugin options within the wp_options table.
Administrator HTTP referrer logs showing settings updates originating from external domains rather than /wp-admin/.
New or modified WordPress administrator accounts created shortly after a CSRF-induced settings change.

Detection Strategies

Audit the wp_options table for plugin configuration entries containing HTML or JavaScript syntax.
Inspect web server access logs for POST requests to plugin admin endpoints lacking a same-origin referrer header.
Compare installed plugin versions against the vulnerable range and flag any instance at or below 1.0.2.

Monitoring Recommendations

Enable WordPress audit logging to record administrative configuration changes and the source IP of each change.
Monitor outbound browser telemetry for unexpected script execution on pages rendered by the Smart DoFollow plugin.
Alert on creation of new administrator accounts or modification of user roles following plugin settings changes.

How to Mitigate CVE-2025-25152

Immediate Actions Required

Deactivate and remove the Smart DoFollow plugin until a patched release is published by the maintainer.
Review and sanitize all existing plugin configuration values to remove any injected HTML or JavaScript.
Force a password reset for all WordPress administrators who may have visited untrusted pages while authenticated.

Patch Information

At the time of publication, no fixed version beyond 1.0.2 has been identified in the available references. Monitor the Patchstack WordPress Vulnerability advisory and the WordPress plugin repository for an updated release.

Workarounds

Remove the plugin entirely if administrative use is not required.
Restrict access to /wp-admin/ using IP allowlisting or a Web Application Firewall (WAF) rule that blocks cross-origin POST requests.
Require administrators to use isolated browser profiles when managing the WordPress site to limit cross-site cookie exposure.

bash

# Configuration example: WAF rule concept to block cross-origin admin POSTs
# Drop POST requests to wp-admin when Referer is missing or external
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1002025,msg:'Block cross-origin wp-admin POST'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/wp-admin/"