CVE-2025-28950: Post Author CSRF Vulnerability

CVE-2025-28950 Overview

CVE-2025-28950 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress Post Author plugin developed by David Shabtai. This security flaw allows attackers to perform unauthorized actions on behalf of authenticated users, ultimately enabling Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions of the Post Author plugin through version 1.1.1.

Critical Impact

Attackers can exploit this CSRF vulnerability to inject malicious scripts that persist in the WordPress database, potentially compromising administrator accounts and enabling further attacks against site visitors.

Affected Products

• WordPress Post Author plugin versions up to and including 1.1.1
• WordPress installations using the vulnerable Post Author plugin
• All users and administrators of affected WordPress sites

Discovery Timeline

• 2025-06-06 - CVE-2025-28950 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-28950

Vulnerability Analysis

This vulnerability represents a compound attack chain combining Cross-Site Request Forgery (CSRF) with Stored Cross-Site Scripting (XSS). The Post Author plugin fails to implement proper CSRF token validation on sensitive form submissions, allowing attackers to craft malicious requests that are executed when an authenticated administrator visits an attacker-controlled page.

The absence of nonce verification means the plugin cannot distinguish between legitimate user requests and forged requests initiated by malicious actors. When combined with insufficient input sanitization, this CSRF weakness enables attackers to inject persistent JavaScript code into the WordPress database through the plugin's functionality.

Root Cause

The root cause of CVE-2025-28950 is improper implementation of Cross-Site Request Forgery protections (CWE-352) in the Post Author plugin. WordPress provides built-in nonce verification functions (wp_nonce_field() and check_admin_referer()) specifically designed to prevent CSRF attacks, but the plugin fails to properly implement these security controls on state-changing operations.

Additionally, the plugin does not adequately sanitize or escape user-supplied input before storing it in the database, which allows the injected payload from the CSRF attack to persist as a Stored XSS vulnerability.

Attack Vector

The attack requires an authenticated WordPress administrator to visit a malicious webpage while logged into the vulnerable WordPress site. The attacker crafts an HTML page containing a hidden form that automatically submits a request to the WordPress site's Post Author plugin endpoint. This forged request includes malicious JavaScript payload that, due to the lack of input sanitization, gets stored in the database.

When the injected content is later rendered on the WordPress site, the malicious script executes in the context of any user viewing the affected page. This can lead to session hijacking, administrative account takeover, website defacement, or the distribution of malware to site visitors.

The attack flow typically involves:

1. Attacker identifies a WordPress site using the vulnerable Post Author plugin
2. Attacker crafts a malicious webpage with an auto-submitting form targeting the plugin's endpoint
3. Attacker tricks an authenticated administrator into visiting the malicious page
4. The forged request stores malicious JavaScript in the WordPress database
5. The stored XSS payload executes when any user views the affected content

Detection Methods for CVE-2025-28950

Indicators of Compromise

• Unexpected JavaScript code appearing in Post Author plugin database entries
• Suspicious form submissions to Post Author plugin endpoints in web server access logs
• User reports of browser security warnings or unexpected behavior when viewing author information
• Evidence of administrator sessions being accessed from unusual IP addresses or locations

Detection Strategies

• Review WordPress database tables associated with the Post Author plugin for unexpected script tags or JavaScript content
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Monitor web application firewall (WAF) logs for CSRF attack patterns targeting WordPress plugin endpoints
• Conduct periodic security scans of WordPress installations to identify vulnerable plugin versions

Monitoring Recommendations

• Enable detailed logging for WordPress admin actions and plugin form submissions
• Configure alerting for any modifications to plugin-related database entries outside of normal administrative workflows
• Monitor for outbound connections from the WordPress server that could indicate successful XSS exploitation
• Implement file integrity monitoring to detect unauthorized changes to WordPress core files and plugin files

How to Mitigate CVE-2025-28950

Immediate Actions Required

• Disable or deactivate the Post Author plugin immediately until a patched version is available
• Review Post Author plugin database entries for any evidence of injected malicious content
• Invalidate all active WordPress administrator sessions to prevent ongoing exploitation
• Audit recent administrative actions and access logs for signs of unauthorized activity

Patch Information

At the time of publication, administrators should monitor the Patchstack WordPress CSRF Vulnerability advisory for updates regarding a security patch. Until a patched version is released, the plugin should remain deactivated on production WordPress installations.

Workarounds

• Deactivate the Post Author plugin entirely until a security update is available
• Implement a Web Application Firewall (WAF) with CSRF protection rules to filter malicious requests
• Restrict administrative access to trusted IP addresses using .htaccess rules or a security plugin
• Consider alternative author display plugins that have been audited for security vulnerabilities