CVE-2025-28913: WP Add Active Class CSRF Vulnerability

CVE-2025-28913 Overview

CVE-2025-28913 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin WP Add Active Class To Menu Item by Aftab Ali Muni. The flaw impacts all versions up to and including 1.0. An attacker can trick an authenticated administrator into submitting a forged request that modifies plugin state without their consent. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows an attacker to perform unauthorized state-changing actions in the plugin through a victim administrator's browser session, requiring only user interaction such as visiting a malicious page.

Affected Products

WordPress plugin: wp-add-active-class-to-menu-item
Vendor: Aftab Ali Muni
Versions: from n/a through <= 1.0

Discovery Timeline

2025-03-11 - CVE-2025-28913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28913

Vulnerability Analysis

The plugin exposes state-changing actions without validating the origin or authenticity of the requesting user. Because no anti-CSRF token or equivalent verification is enforced, any authenticated administrator visiting an attacker-controlled page can be forced to issue requests to the affected WordPress site. The attacker leverages the victim's existing authenticated session to submit those requests. According to the EPSS scoring, exploitation likelihood is low, but the attack requires no privileges from the attacker's side.

Root Cause

The root cause is missing CSRF protection on plugin request handlers. WordPress provides nonce primitives such as wp_nonce_field() and check_admin_referer() to defend against these attacks. The affected plugin fails to generate and validate these tokens on the vulnerable endpoints. As a result, browser-issued requests carrying session cookies are indistinguishable from legitimate administrator actions.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts a malicious page containing an auto-submitting form or image tag that targets the plugin's action URL. When a logged-in administrator visits the page, their browser attaches WordPress authentication cookies to the forged request. The plugin then processes the request as if it originated from a legitimate admin panel action. Details are documented in the Patchstack Vulnerability Report.

No verified public proof-of-concept code is available. The vulnerability mechanism is a standard CSRF pattern: a forged HTTP request from a third-party origin triggering privileged actions on the target site.

Detection Methods for CVE-2025-28913

Indicators of Compromise

Unexpected changes to menu item CSS classes or plugin configuration made outside normal administrator workflows.
HTTP POST requests to plugin endpoints with Referer or Origin headers pointing to external, untrusted domains.
Administrator session activity coinciding with visits to unfamiliar external URLs in browser history.

Detection Strategies

Inspect web server access logs for cross-origin requests targeting plugin action URLs while an admin session is active.
Enable WordPress audit logging to correlate configuration changes with the initiating user and request source.
Review web application firewall (WAF) logs for requests missing valid nonce parameters on plugin endpoints.

Monitoring Recommendations

Alert on modifications to WordPress plugin settings when the HTTP Referer is not the site's own admin URL.
Track administrator account activity for anomalous request patterns immediately after clicking external links.
Ingest WordPress and reverse-proxy logs into a centralized SIEM to correlate CSRF-style request chains.

How to Mitigate CVE-2025-28913

Immediate Actions Required

Deactivate and remove the wp-add-active-class-to-menu-item plugin if it is not essential to site operations.
Restrict administrative access to trusted networks and require re-authentication for privileged actions.
Instruct administrators to log out of WordPress before browsing untrusted sites.

Patch Information

No fixed version is listed in the advisory. The vulnerability affects all releases up to 1.0, and no patched build is currently referenced by the vendor. Site owners should monitor the Patchstack Vulnerability Report for updates or replace the plugin with a maintained alternative.

Workarounds

Deploy a WAF rule that enforces same-origin Referer and Origin headers on all wp-admin POST requests.
Use a browser session isolation policy so administrators only access WordPress from a dedicated browser profile.
Apply the SameSite=Strict attribute on WordPress authentication cookies via server or reverse-proxy configuration to block cross-site cookie transmission.

bash

# Example nginx snippet enforcing SameSite on WordPress auth cookies
proxy_cookie_flags wordpress_logged_in_* samesite=strict secure httponly;
proxy_cookie_flags wordpress_sec_* samesite=strict secure httponly;