CVE-2025-27336: Just Variables WordPress Plugin CSRF Flaw

CVE-2025-27336 Overview

CVE-2025-27336 is a Cross-Site Request Forgery (CSRF) vulnerability in the Just Variables WordPress plugin (just-wp-variables) developed by Alex Prokopenko / JustCoded. The flaw affects all plugin versions up to and including 1.2.3. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unintended state-changing actions on the target site. Exploitation requires user interaction but no privileges or authentication on the attacker's side. The weakness is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows attackers to perform unauthorized actions in the context of an authenticated WordPress user, leading to limited integrity impact on plugin-managed variables.

Affected Products

Just Variables WordPress plugin (just-wp-variables) versions through 1.2.3
WordPress sites running the vulnerable plugin
Administrator or privileged user sessions on affected installations

Discovery Timeline

2025-02-24 - CVE-2025-27336 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27336

Vulnerability Analysis

The Just Variables plugin exposes state-changing endpoints without adequate CSRF protection. Authenticated administrative actions in the plugin lack proper anti-CSRF token verification, such as the WordPress wp_nonce_field() and check_admin_referer() mechanisms. An attacker who lures an authenticated user to a malicious page can force the browser to submit a forged request to the vulnerable WordPress site. The browser automatically attaches the user's session cookies, allowing the request to execute with the victim's privileges. The Exploit Prediction Scoring System places this issue in the lower likelihood range for near-term exploitation.

Root Cause

The root cause is missing or insufficient CSRF token validation on plugin request handlers that modify server-side state. Without validating a unique per-session nonce, the plugin cannot distinguish between legitimate browser requests and forged cross-origin requests. This falls squarely within CWE-352.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker hosts a page containing a hidden form or JavaScript that auto-submits a POST request to the vulnerable WordPress endpoint. A logged-in administrator visits the page, and the browser issues the forged request with valid session cookies. The plugin processes the request as legitimate and modifies variables or plugin settings accordingly. See the Patchstack advisory for additional context.

Detection Methods for CVE-2025-27336

Indicators of Compromise

Unexpected modifications to Just Variables plugin settings or defined variables in wp-admin
HTTP POST requests to plugin endpoints originating from external Referer headers
Administrative changes logged outside of typical maintenance windows
Absence of nonce parameters in plugin state-changing requests

Detection Strategies

Inspect WordPress access logs for requests to just-wp-variables endpoints with foreign or missing Referer and Origin headers
Correlate administrator browser sessions with unexpected plugin configuration changes
Deploy a Web Application Firewall (WAF) rule that flags POST requests to the plugin lacking a valid nonce parameter

Monitoring Recommendations

Enable WordPress audit logging plugins to capture all administrative configuration changes
Monitor for unusual outbound requests from admin browser sessions to unknown domains preceding plugin changes
Alert on requests to /wp-admin/admin.php or /wp-admin/admin-post.php that reference the plugin without expected token parameters

How to Mitigate CVE-2025-27336

Immediate Actions Required

Update Just Variables to a version later than 1.2.3 once a patched release is available from the vendor
Restrict administrative access to WordPress via IP allowlisting where feasible
Instruct administrators to log out of wp-admin sessions when not actively performing maintenance
Review recent plugin configuration changes for unauthorized modifications

Patch Information

At the time of publication, refer to the Patchstack vulnerability entry for the latest patch status. Apply any vendor-supplied update that introduces wp_nonce_field() and check_admin_referer() validation on affected endpoints.

Workarounds

Deactivate the Just Variables plugin until a patched version is released if the plugin is not business-critical
Deploy a WAF rule to block POST requests to plugin endpoints missing the WordPress nonce parameter (_wpnonce)
Configure the SameSite=Lax or SameSite=Strict attribute on WordPress session cookies to reduce cross-origin request risk
Train administrators to avoid browsing untrusted sites while authenticated to WordPress

bash

# Example WAF rule (ModSecurity) to block plugin requests missing a nonce
SecRule REQUEST_URI "@contains just-wp-variables" \
    "chain,phase:2,deny,status:403,id:1002701,msg:'CSRF: missing _wpnonce for Just Variables plugin'"
    SecRule REQUEST_METHOD "@streq POST" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"