CVE-2025-28887 Overview
CVE-2025-28887 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Fastmover Plugins Last Updated Column WordPress plugin. The flaw impacts all plugin versions up to and including 0.1.3. An attacker can craft a malicious web page that triggers unintended state-changing actions when an authenticated WordPress user visits the page. Exploitation requires user interaction and results in limited integrity impact on the target site. The weakness is categorized under CWE-352: Cross-Site Request Forgery.
Critical Impact
An authenticated WordPress administrator tricked into visiting a malicious page can have plugin-controlled actions executed on their site without consent.
Affected Products
- Fastmover Plugins Last Updated Column plugin for WordPress
- All versions from initial release through 0.1.3
- WordPress sites with the plugin installed and an authenticated administrator session
Discovery Timeline
- 2025-03-11 - CVE-2025-28887 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28887
Vulnerability Analysis
The Plugins Last Updated Column plugin exposes state-changing endpoints without adequate CSRF protection. WordPress provides nonce-based anti-CSRF primitives through wp_nonce_field() and check_admin_referer(), but the affected handlers do not validate a request-bound nonce. As a result, any authenticated request originating from a third-party domain is honored by the plugin.
Exploitation follows the standard CSRF pattern. An attacker hosts a page containing a hidden form or img tag that issues a request to the vulnerable WordPress endpoint. When a logged-in administrator visits the page, the browser attaches session cookies and the request is processed with the victim's privileges. User interaction is required, which limits mass exploitation but remains realistic through phishing.
Root Cause
The root cause is missing anti-CSRF token validation on privileged plugin actions. The handlers accept authenticated requests based solely on cookie-driven session state, without verifying request origin or a per-session nonce. This design fails to satisfy the OWASP guidance for state-changing operations.
Attack Vector
The attack vector is network-based over HTTP and requires user interaction. Confidentiality and availability are not directly impacted, but integrity of plugin-managed settings can be modified. Refer to the Patchstack WordPress Vulnerability Advisory for advisory details. No public proof-of-concept exploit is currently indexed for this CVE.
Detection Methods for CVE-2025-28887
Indicators of Compromise
- Unexpected changes to Plugins Last Updated Column plugin settings or configuration entries in the WordPress database.
- HTTP POST or GET requests to plugin admin endpoints with a Referer header pointing to an external, untrusted domain.
- Administrator-session requests to /wp-admin/ handlers lacking a valid _wpnonce parameter.
Detection Strategies
- Enable WordPress audit logging to record administrator actions and correlate them with browser session context and Referer values.
- Inspect web server access logs for state-changing requests to plugin endpoints without the expected nonce query parameter.
- Alert on off-hours administrative changes to plugin options tied to plugins-last-updated-column.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized analytics platform for cross-request correlation.
- Baseline normal administrator activity and flag anomalous cross-origin request patterns.
- Monitor outbound network requests from administrator workstations for phishing lures targeting WordPress operators.
How to Mitigate CVE-2025-28887
Immediate Actions Required
- Deactivate the Plugins Last Updated Column plugin until a patched release is available from the vendor.
- Require administrators to log out of WordPress sessions when not actively performing management tasks.
- Restrict /wp-admin/ access by source IP address using a web application firewall or reverse proxy rules.
Patch Information
At the time of publication, no fixed version above 0.1.3 is referenced in the advisory. Monitor the Patchstack advisory and the WordPress plugin repository for a vendor update that introduces nonce validation on affected handlers.
Workarounds
- Remove the plugin from production environments where it is not operationally required.
- Deploy a WAF rule that blocks requests to plugin admin endpoints missing a valid _wpnonce parameter.
- Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-site request risk.
- Train administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
