CVE-2025-28902: Contact Form 7 Select Box CSRF Vulnerability

CVE-2025-28902 Overview

CVE-2025-28902 is a Cross-Site Request Forgery (CSRF) vulnerability in the Benjamin Pick Contact Form 7 Select Box Editor Button WordPress plugin. The flaw affects all versions from initial release through 0.6. The plugin fails to validate the origin of state-changing requests, allowing attackers to trigger unauthorized actions when an authenticated administrator visits a malicious page. The issue is tracked under CWE-352 and requires user interaction over the network to succeed.

Critical Impact
Authenticated administrators can be tricked into performing unintended actions on the target WordPress site, resulting in limited integrity impact on plugin-managed configuration.

Affected Products

Contact Form 7 Select Box Editor Button plugin for WordPress
All versions up to and including 0.6
WordPress installations using the contact-form-7-select-box-editor-button plugin

Discovery Timeline

2025-03-11 - CVE-2025-28902 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28902

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF protection in the Contact Form 7 Select Box Editor Button plugin. State-changing endpoints exposed by the plugin do not verify a WordPress nonce or comparable token before processing requests. An attacker can craft an HTML page or hidden form that submits a request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser automatically attaches the WordPress session cookies, and the plugin processes the forged request as legitimate.

The Exploit Prediction Scoring System (EPSS) score for this issue is 0.158%, indicating a low probability of exploitation activity in the near term. No public exploit code or CISA Known Exploited Vulnerabilities Catalog listing is associated with this CVE.

Root Cause

The root cause is the absence of nonce verification on administrative actions handled by the plugin. WordPress provides wp_nonce_field() and check_admin_referer() primitives to protect against CSRF, but the affected plugin code paths omit these checks. Any request that arrives with valid session cookies is honored, regardless of origin.

Attack Vector

Exploitation requires an authenticated WordPress administrator to visit an attacker-controlled URL while logged in. The attacker hosts a page containing a hidden form or JavaScript that auto-submits a POST request to the vulnerable plugin endpoint. Because the browser attaches valid WordPress cookies, the server accepts the request. The attack vector is network-based, requires no privileges from the attacker, and depends on user interaction with a malicious link or embedded content.

See the Patchstack CSRF Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-28902

Indicators of Compromise

Unexpected modifications to Contact Form 7 select box configurations without corresponding administrator activity logs
Web server access logs showing POST requests to plugin endpoints with Referer headers from external domains
Administrator sessions active during navigation to unfamiliar external sites shortly before configuration changes

Detection Strategies

Review WordPress audit logs for plugin configuration changes correlated with administrator browsing history
Inspect HTTP access logs for requests to contact-form-7-select-box-editor-button endpoints missing valid _wpnonce parameters
Deploy a Web Application Firewall (WAF) rule to flag cross-origin POST requests targeting /wp-admin/ endpoints

Monitoring Recommendations

Enable WordPress activity logging plugins to capture administrator-initiated changes with source IP and referer metadata
Alert on POST requests to WordPress admin endpoints where the Origin or Referer header does not match the site domain
Monitor administrator accounts for behavioral anomalies such as configuration changes performed outside normal working hours

How to Mitigate CVE-2025-28902

Immediate Actions Required

Deactivate the Contact Form 7 Select Box Editor Button plugin until a patched release is available
Restrict WordPress administrator access to trusted networks using IP allowlisting on /wp-admin/
Instruct administrators to log out of WordPress sessions before browsing external sites

Patch Information

At the time of publication, no fixed version beyond 0.6 is referenced in the CVE record. Site owners should monitor the Patchstack advisory and the plugin repository for an updated release that adds nonce verification to affected endpoints.

Workarounds

Remove or disable the plugin if it is not essential to site functionality
Deploy a WAF rule that rejects state-changing requests to WordPress admin endpoints lacking a same-origin Referer header
Enforce short administrator session lifetimes and require reauthentication for sensitive actions

bash

# Example WAF rule (ModSecurity) to block cross-origin admin POSTs
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1002801,phase:1,deny,status:403,msg:'Cross-origin admin POST blocked'"
  SecRule REQUEST_URI "@contains /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://example.com/"