CVE-2025-28923: No Disposable Email CSRF Vulnerability

CVE-2025-28923 Overview

CVE-2025-28923 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress "No Disposable Email" plugin developed by philippe. This security flaw enables attackers to chain CSRF with Stored Cross-Site Scripting (XSS), allowing malicious actors to inject persistent scripts into the WordPress site when an authenticated administrator is tricked into performing unintended actions.

The vulnerability exists in the plugin's handling of user input without proper CSRF token validation, allowing attackers to craft malicious requests that execute in the context of an authenticated administrator's session. When combined with the stored XSS component, this creates a dangerous attack chain that can lead to complete site compromise.

Critical Impact

Attackers can leverage this CSRF-to-Stored-XSS chain to inject persistent malicious scripts, potentially stealing administrator credentials, creating rogue admin accounts, or distributing malware to site visitors.

Affected Products

• WordPress No Disposable Email plugin versions up to and including 2.5.1
• WordPress sites using the vulnerable no-disposable-email plugin

Discovery Timeline

• 2025-03-11 - CVE-2025-28923 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-28923

Vulnerability Analysis

This vulnerability combines two distinct attack techniques: Cross-Site Request Forgery (CWE-352) and Stored Cross-Site Scripting. The CSRF component allows an attacker to bypass the same-origin policy by tricking an authenticated WordPress administrator into submitting a malicious request. Because the plugin fails to implement proper CSRF token validation (nonce verification) on sensitive administrative actions, attackers can craft malicious pages or emails containing hidden forms or JavaScript that automatically submit requests to the vulnerable plugin endpoints.

The stored XSS component means that the malicious payload persists in the WordPress database and executes whenever the affected page or administrative interface is loaded. This persistence makes the vulnerability particularly dangerous, as the malicious script continues to execute for all users who access the compromised content until it is manually removed.

Root Cause

The root cause of this vulnerability is the lack of proper CSRF protection mechanisms (WordPress nonces) on plugin settings or configuration endpoints that accept and store user-controlled input. WordPress provides built-in functions like wp_nonce_field() and wp_verify_nonce() specifically to prevent CSRF attacks, but the No Disposable Email plugin fails to implement these protections on vulnerable endpoints. Additionally, input sanitization using functions like wp_kses() or esc_html() is not properly applied to user-supplied data before storing it in the database, enabling the stored XSS payload to persist.

Attack Vector

The attack vector requires social engineering to trick an authenticated administrator into visiting an attacker-controlled page or clicking a malicious link. The attack typically unfolds as follows:

1. The attacker identifies an unprotected administrative action in the No Disposable Email plugin settings
2. The attacker crafts a malicious HTML page containing a hidden form with XSS payload targeting the vulnerable endpoint
3. The form is automatically submitted using JavaScript when an administrator visits the page
4. The plugin processes the request without validating the CSRF token and stores the malicious script
5. When any user (including administrators) views the affected settings page or output, the stored XSS payload executes

The attacker-controlled page could be hosted on any domain and delivered via phishing emails, malicious advertisements, or compromised websites. Once the stored XSS is in place, it can steal session cookies, redirect users to phishing pages, inject cryptocurrency miners, or perform administrative actions on behalf of the victim.

Detection Methods for CVE-2025-28923

Indicators of Compromise

• Unexpected JavaScript code present in plugin settings or database entries related to No Disposable Email
• Unauthorized administrative actions such as new user creation or plugin installations without admin knowledge
• Browser console errors indicating blocked or suspicious script execution attempts
• Unusual outbound requests from the WordPress admin interface to unknown external domains

Detection Strategies

• Review WordPress database tables for unexpected <script> tags or JavaScript event handlers in plugin-related options
• Enable WordPress debug logging and monitor for unusual plugin activity or errors
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attacks and XSS payloads
• Use security plugins that scan for known vulnerable plugin versions and malicious code injection

Monitoring Recommendations

• Configure server access logs to alert on suspicious POST requests to the No Disposable Email plugin endpoints
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Set up file integrity monitoring to detect unauthorized changes to plugin files or WordPress options
• Monitor for new administrator accounts or privilege escalation events that may indicate successful exploitation

How to Mitigate CVE-2025-28923

Immediate Actions Required

• Immediately deactivate and remove the No Disposable Email plugin version 2.5.1 or earlier from all WordPress installations
• Audit the WordPress database for any injected malicious scripts in plugin-related options tables
• Review administrator accounts and remove any unauthorized users that may have been created through exploitation
• Clear all browser caches and WordPress transients to ensure cached malicious content is removed

Patch Information

At the time of this advisory, the vulnerability affects all versions through 2.5.1. Administrators should check the Patchstack Vulnerability Report for updated patch availability and remediation guidance. If no patch is available, consider using an alternative plugin that provides similar disposable email blocking functionality with proper security controls.

Workarounds

• Disable or remove the vulnerable plugin until a security patch is released by the developer
• Implement a Web Application Firewall (WAF) with rules to block CSRF attacks and common XSS payloads
• Restrict access to the WordPress admin interface using IP allowlisting or VPN requirements to reduce attack surface
• Use browser extensions like NoScript or uBlock Origin to prevent automatic form submissions on administrator browsers