CVE-2025-28912 Overview
CVE-2025-28912 is a Cross-Site Request Forgery (CSRF) vulnerability in the Muntasir Rahman Custom Dashboard Page plugin for WordPress. The flaw affects all versions of the custom-dashboard-page plugin up to and including version 1.0. The issue is tracked under [CWE-352] and stems from missing or improper CSRF token validation on state-changing requests.
An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, forces the browser to submit unauthorized requests to the plugin. Successful exploitation requires user interaction, such as clicking a link while logged in to the target site.
Critical Impact
Attackers can trigger unauthorized plugin actions on behalf of authenticated WordPress users, resulting in limited integrity impact on the site configuration.
Affected Products
- Muntasir Rahman Custom Dashboard Page plugin for WordPress
- Versions from unspecified initial release through 1.0 (inclusive)
- WordPress installations with the custom-dashboard-page plugin enabled
Discovery Timeline
- 2025-03-11 - CVE-2025-28912 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28912
Vulnerability Analysis
The Custom Dashboard Page plugin fails to verify the origin of state-changing HTTP requests. WordPress provides nonce mechanisms (wp_nonce_field(), check_admin_referer(), and wp_verify_nonce()) to defend against CSRF, but the affected plugin does not enforce them on the vulnerable endpoints.
Exploitation requires a target user to be authenticated to the WordPress site and to visit an attacker-controlled page. The browser then submits a forged request carrying the user's session cookies, and the plugin processes the action without confirming user intent. The resulting impact is limited to integrity — no direct data disclosure or denial of service occurs from the flaw itself.
Root Cause
The root cause is missing anti-CSRF token validation on privileged plugin actions. Requests are accepted based solely on the presence of a valid WordPress authentication cookie, which browsers attach automatically to cross-site requests. Without a nonce check, the plugin cannot distinguish between an intentional administrator action and a forged submission.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a page containing an HTML form or JavaScript that submits a request to the vulnerable plugin endpoint on the target WordPress site. When an authenticated user loads the page, the browser sends the request with valid session cookies, and the plugin executes the requested action. No credentials or privileges are needed on the attacker side.
No public proof-of-concept exploit or working exploit code has been published for this issue. See the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-28912
Indicators of Compromise
- Unexpected changes to Custom Dashboard Page plugin configuration or dashboard content
- WordPress access logs showing POST requests to plugin endpoints with external Referer headers
- Administrative actions performed at times inconsistent with legitimate administrator activity
Detection Strategies
- Review WordPress audit logs for plugin configuration changes that lack a corresponding administrator session context
- Inspect HTTP request logs for POST requests to custom-dashboard-page handlers originating from off-domain referrers
- Correlate browser session activity with administrator workstations to identify forged submissions
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture all administrative actions with source IP and referrer data
- Monitor for anomalous cross-origin requests directed at /wp-admin/ endpoints associated with the plugin
- Alert on plugin setting modifications outside approved change windows
How to Mitigate CVE-2025-28912
Immediate Actions Required
- Deactivate the Custom Dashboard Page plugin until a patched version is confirmed available
- Restrict WordPress administrator sessions to dedicated browser profiles that do not browse untrusted sites
- Enforce administrator logout after use to reduce the window in which a CSRF request would succeed
Patch Information
No fixed version has been published at the time of the NVD entry. The vulnerability affects the plugin through version 1.0, and no later release is referenced in the advisory. Site administrators should monitor the Patchstack Vulnerability Report and the plugin repository for updates.
Workarounds
- Remove the custom-dashboard-page plugin from production WordPress installations
- Deploy a web application firewall rule that blocks POST requests to plugin endpoints lacking a same-origin Referer header
- Require re-authentication for administrator sessions and shorten cookie lifetimes to limit CSRF exposure
# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate custom-dashboard-page
wp plugin delete custom-dashboard-page
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
