CVE-2025-28886 Overview
CVE-2025-28886 is a Cross-Site Request Forgery (CSRF) vulnerability in the rest-api-to-miniprogram WordPress plugin developed by xjb. The flaw affects all versions of REST API TO MiniProgram up to and including 5.1.2. An attacker can trick an authenticated user into submitting forged requests that perform unintended state-changing actions on the WordPress site. The vulnerability is tracked under CWE-352 and is exploitable over the network with low attack complexity but requires user interaction. Successful exploitation results in limited integrity impact without compromising confidentiality or availability.
Critical Impact
Attackers can perform unauthorized state-changing actions in the REST API TO MiniProgram plugin by luring authenticated WordPress users to visit a malicious page.
Affected Products
- xjb REST API TO MiniProgram plugin for WordPress
- All versions from n/a through 5.1.2
- WordPress installations with the rest-api-to-miniprogram plugin enabled
Discovery Timeline
- 2025-03-11 - CVE-2025-28886 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28886
Vulnerability Analysis
The vulnerability stems from missing anti-CSRF protections in the REST API TO MiniProgram plugin. WordPress provides nonce-based request verification through wp_nonce_field() and check_admin_referer(), but the affected plugin endpoints do not validate these tokens on state-changing operations. This allows a third-party site to forge authenticated requests through the victim's browser session.
The attack requires user interaction, meaning the target must be logged into WordPress and must visit an attacker-controlled page or click a crafted link. The vulnerability produces limited integrity impact, indicating that specific plugin settings or data can be modified without the user's consent. Confidentiality and availability remain unaffected because the flaw does not disclose data or disrupt service.
The EPSS score of 0.158% suggests low near-term exploitation probability, though the network-accessible nature of WordPress deployments keeps the attack surface broad.
Root Cause
The root cause is the absence of CSRF token validation on plugin request handlers. WordPress plugins must implement nonce checks using wp_verify_nonce() or check_ajax_referer() on any endpoint that modifies server-side state. The rest-api-to-miniprogram plugin fails to enforce this control on one or more request handlers up through version 5.1.2.
Attack Vector
An attacker crafts a malicious HTML page containing a hidden form or JavaScript that submits a request to the vulnerable plugin endpoint. When a logged-in WordPress administrator or privileged user visits the page, the browser attaches the user's authentication cookies to the forged request. The plugin processes the request as legitimate and executes the state-changing action. Details are available in the Patchstack WordPress Vulnerability Advisory.
Detection Methods for CVE-2025-28886
Indicators of Compromise
- Unexpected changes to REST API TO MiniProgram plugin configuration or associated WordPress options
- Requests to plugin endpoints containing Referer headers pointing to unrelated external domains
- POST requests to plugin handlers lacking a valid WordPress nonce parameter (_wpnonce)
- Unusual activity in WordPress audit logs tied to authenticated administrator sessions immediately after external site visits
Detection Strategies
- Inventory WordPress installations and identify sites running rest-api-to-miniprogram version 5.1.2 or earlier
- Review web server access logs for POST requests to plugin endpoints originating from cross-origin referrers
- Deploy a Web Application Firewall (WAF) rule to flag requests to the plugin lacking WordPress nonce tokens
- Correlate administrator browser activity with subsequent plugin configuration changes
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture configuration changes with user attribution
- Alert on HTTP requests to /wp-admin/admin-ajax.php and plugin routes with mismatched Origin and Host headers
- Monitor for spikes in authenticated administrator requests immediately following outbound web traffic
How to Mitigate CVE-2025-28886
Immediate Actions Required
- Identify all WordPress instances running the REST API TO MiniProgram plugin at version 5.1.2 or earlier
- Disable the plugin until a patched release is confirmed available from the vendor
- Require administrators to log out of WordPress before browsing untrusted sites
- Restrict administrative access to trusted network locations where feasible
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry. Review the Patchstack WordPress Vulnerability Advisory and the plugin's official repository for updates. Apply any vendor-issued update above version 5.1.2 once released.
Workarounds
- Deactivate the rest-api-to-miniprogram plugin until a patched version is installed
- Deploy a WAF rule requiring a valid _wpnonce parameter on all plugin POST requests
- Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress session cookies to reduce cross-site request risk
- Implement Content Security Policy (CSP) headers that restrict form submission targets on administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
