CVE-2025-28909: WP No-Bot Question CSRF Vulnerability

CVE-2025-28909 Overview

CVE-2025-28909 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the WP No-Bot Question WordPress plugin developed by edwardw. The flaw impacts all plugin versions from n/a through 0.1.7. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, submits forged requests to the vulnerable plugin without the user's consent.

Critical Impact
Successful exploitation allows an attacker to trigger state-changing actions in the plugin using the victim's authenticated session, resulting in limited integrity impact on the affected WordPress site.

Affected Products

WP No-Bot Question plugin for WordPress
Versions from n/a through 0.1.7
Vendor: edwardw

Discovery Timeline

2025-03-11 - CVE-2025-28909 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28909

Vulnerability Analysis

The vulnerability originates from missing or inadequate anti-CSRF protections in the WP No-Bot Question plugin. WordPress provides a nonce mechanism (wp_nonce_field() and check_admin_referer()) that plugins must implement to validate the origin of state-changing requests. When these checks are absent, the plugin cannot distinguish between legitimate user-initiated requests and requests forged by an attacker.

Exploitation requires user interaction (UI:R). An attacker must convince an authenticated WordPress user, typically an administrator, to visit an attacker-controlled page or click a crafted link. Once triggered, the browser automatically includes valid session cookies with the forged request, causing the plugin to process the action as authorized.

The scope of impact is limited to integrity. The vulnerability does not directly expose sensitive data or degrade availability, but it enables unauthorized modifications to plugin state or settings.

Root Cause

The root cause is the absence of a valid CSRF token check on one or more request handlers within the plugin (up to and including version 0.1.7). Without nonce validation, the plugin treats any authenticated request as legitimate regardless of origin.

Attack Vector

The attack vector is network-based through the browser. An attacker hosts a malicious page containing an auto-submitting HTML form or an image tag that issues a request to the target WordPress site. When an authenticated victim loads the page, the browser sends the forged request along with valid session cookies to the vulnerable plugin endpoint. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-28909

Indicators of Compromise

Unexpected changes to WP No-Bot Question plugin configuration or settings in the WordPress database.
HTTP POST requests to the plugin's admin endpoints with Referer headers pointing to external, untrusted domains.
WordPress admin action log entries showing configuration changes without corresponding administrator activity.

Detection Strategies

Inspect web server access logs for POST requests to plugin admin URLs where the Referer header is missing or does not match the site's own domain.
Enable WordPress audit logging to record administrative actions and correlate them with authenticated user sessions.
Compare current plugin settings against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) with CSRF-detection rules targeting the plugin's endpoints.
Alert on WordPress admin-post.php and admin-ajax.php invocations that lack a valid nonce parameter.
Track outbound referrers for administrator sessions and flag transitions from untrusted third-party sites to wp-admin URLs.

How to Mitigate CVE-2025-28909

Immediate Actions Required

Deactivate the WP No-Bot Question plugin until a patched version is available from the vendor.
Audit WordPress administrator sessions and revoke active sessions to invalidate any tokens that may have been abused.
Review plugin-managed settings and question/answer data for unauthorized changes and restore from a trusted backup if tampering is detected.

Patch Information

At the time of publication, no fixed version has been identified in the referenced Patchstack Vulnerability Report. All versions through 0.1.7 are affected. Monitor the plugin's WordPress.org listing and the Patchstack advisory for an official update.

Workarounds

Remove the plugin from any production WordPress installation until a vendor patch is released.
Enforce a strict SameSite=Lax or SameSite=Strict cookie policy on WordPress authentication cookies to reduce cross-site request risk.
Instruct administrators to log out of wp-admin before browsing untrusted sites and to use a dedicated browser profile for WordPress administration.
Deploy a WAF rule to reject requests to the plugin's endpoints that lack a valid WordPress nonce parameter.

bash

# Example WAF rule concept (ModSecurity) to block CSRF against the plugin
SecRule REQUEST_URI "@rx /wp-admin/.*wp-no-bot-question" \
  "phase:2,deny,status:403,id:1002890,\
   chain,msg:'CVE-2025-28909 CSRF attempt blocked'"
    SecRule &ARGS:_wpnonce "@eq 0"