CVE-2025-27335 Overview
CVE-2025-27335 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Auto Tag Links WordPress plugin developed by Free plug in by SEO Roma. The flaw impacts all plugin versions up to and including 1.0.13. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing requests against the target site. The vulnerability is tracked under CWE-352 and requires user interaction to succeed.
Critical Impact
Successful exploitation lets an attacker perform unauthorized actions in the context of an authenticated user, potentially altering plugin configuration and site tagging behavior.
Affected Products
- Auto Tag Links WordPress plugin — versions up to and including 1.0.13
- Vendor: Free plug in by SEO Roma
- WordPress sites with the vulnerable plugin activated
Discovery Timeline
- 2025-02-24 - CVE-2025-27335 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-27335
Vulnerability Analysis
The Auto Tag Links plugin fails to validate the authenticity of state-changing HTTP requests. The plugin's request handlers do not verify a WordPress nonce or equivalent anti-CSRF token before executing sensitive operations. As a result, an attacker who controls an external site can embed a forged request that a logged-in WordPress user unknowingly submits.
Because the browser automatically attaches the victim's WordPress session cookies, the plugin processes the forged request as if it originated from the legitimate user. The issue has limited integrity impact and no direct confidentiality or availability impact, but it can be chained with social engineering to modify plugin behavior.
Root Cause
The root cause is missing or improperly implemented CSRF protection in the plugin's administrative request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, and the plugin does not enforce these checks on affected endpoints. This falls under CWE-352: Cross-Site Request Forgery.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting HTML form or image tag pointing at a vulnerable plugin endpoint. When an authenticated WordPress administrator or privileged user visits the page, their browser issues the request with valid session cookies attached. The plugin executes the action without verifying request origin or token authenticity.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-27335
Indicators of Compromise
- Unexpected changes to Auto Tag Links plugin configuration or tag mappings without a corresponding admin action in the WordPress audit log
- HTTP POST or GET requests to plugin endpoints containing a Referer header pointing to an external, untrusted domain
- Administrative sessions submitting plugin actions immediately after visiting an unrelated third-party site
Detection Strategies
- Inspect web server access logs for requests to Auto Tag Links plugin URIs where the Referer header is missing or references a domain outside the WordPress installation
- Enable WordPress security auditing plugins to record configuration changes and correlate them with authenticated user activity
- Deploy a Web Application Firewall (WAF) ruleset that flags state-changing requests to /wp-admin/ endpoints lacking a valid _wpnonce parameter
Monitoring Recommendations
- Continuously monitor changes to plugin settings tables in the WordPress database and alert on modifications outside change windows
- Track outbound browser navigation from privileged administrator workstations and correlate with WordPress admin activity
- Ingest WordPress and web server logs into a centralized analytics platform to hunt for CSRF-shaped request patterns
How to Mitigate CVE-2025-27335
Immediate Actions Required
- Update the Auto Tag Links plugin to a version later than 1.0.13 once the vendor publishes a patched release
- If no fixed version is available, deactivate and remove the Auto Tag Links plugin from affected WordPress installations
- Require administrators to log out of WordPress before browsing untrusted external sites and enforce short session lifetimes
Patch Information
At the time of publication, the Patchstack advisory lists the vulnerability as affecting versions up to and including 1.0.13. Administrators should monitor the WordPress plugin repository and the vendor's release notes for an updated version that implements nonce verification on all state-changing endpoints.
Workarounds
- Deploy a Web Application Firewall (WAF) rule requiring a valid WordPress _wpnonce parameter on all requests to Auto Tag Links plugin endpoints
- Restrict WordPress administrator access by source IP address using web server configuration to reduce exposure to opportunistic CSRF attacks
- Enforce the SameSite=Strict attribute on WordPress session cookies to block cross-site cookie transmission from third-party origins
# Example: enforce SameSite=Strict on WordPress auth cookies via Apache
Header edit Set-Cookie ^(wordpress_.*)$ "$1; SameSite=Strict; Secure; HttpOnly"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
