CVE-2025-28981: WP Mail Options CSRF Vulnerability

CVE-2025-28981 Overview

CVE-2025-28981 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Mail Options WordPress plugin by Soli. This security flaw enables attackers to chain CSRF with Stored Cross-Site Scripting (XSS), allowing malicious actors to execute arbitrary JavaScript code in the context of authenticated administrator sessions. The vulnerability exists in all versions of the plugin up to and including version 0.2.3.

Critical Impact

Attackers can leverage this CSRF-to-Stored-XSS chain to hijack administrator sessions, modify plugin settings, inject persistent malicious scripts, and potentially gain full control over affected WordPress installations.

Affected Products

• WP Mail Options WordPress Plugin versions up to and including 0.2.3
• WordPress installations using the vulnerable wp-mail-options plugin

Discovery Timeline

• 2025-06-06 - CVE-2025-28981 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-28981

Vulnerability Analysis

This vulnerability combines two attack vectors to achieve persistent code execution. The WP Mail Options plugin fails to implement proper CSRF token validation on its administrative forms, allowing attackers to craft malicious requests that authenticated administrators can unknowingly execute. When combined with insufficient output sanitization, this enables the injection of malicious JavaScript that persists in the WordPress database and executes whenever the affected administrative pages are viewed.

The CSRF-to-XSS attack chain is particularly dangerous because it bypasses the same-origin policy protections that would normally prevent cross-site attacks. An attacker can host a malicious page containing a hidden form that automatically submits to the vulnerable plugin endpoint when visited by an authenticated WordPress administrator.

Root Cause

The root cause of CVE-2025-28981 is twofold. First, the plugin lacks proper nonce verification on form submissions in administrative interfaces, violating WordPress security best practices for CSRF protection. Second, user-supplied input is stored without adequate sanitization and rendered without proper output escaping, enabling the stored XSS component of this attack chain.

Attack Vector

An attacker exploiting this vulnerability would craft a malicious webpage containing an auto-submitting form targeting the WP Mail Options settings endpoint. When an authenticated WordPress administrator visits this page (through social engineering, phishing, or compromised advertising), the form automatically submits malicious JavaScript code to the plugin's settings. This script is then stored in the WordPress database and executed whenever the administrative interface is accessed.

The attack requires no authentication on the attacker's part—they only need to trick an authenticated administrator into visiting a malicious page. Once the XSS payload is stored, it can execute actions with full administrator privileges, including creating new admin accounts, installing backdoors, or modifying site content.

Detection Methods for CVE-2025-28981

Indicators of Compromise

• Unexpected JavaScript code present in WP Mail Options plugin settings
• New administrator accounts created without authorization
• Modified WordPress core files or theme files
• Unusual outbound connections from the WordPress server to unknown domains
• Browser console errors indicating blocked XSS attempts on admin pages

Detection Strategies

• Review WP Mail Options settings for any unexpected or suspicious configuration values containing script tags or JavaScript
• Audit WordPress user accounts for unauthorized administrator-level accounts
• Monitor HTTP logs for suspicious POST requests to the plugin's settings endpoints from external referrers
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns

Monitoring Recommendations

• Enable WordPress audit logging to track all administrative setting changes
• Configure alerts for new user account creation, especially administrator accounts
• Monitor for modifications to plugin and theme files through file integrity monitoring
• Review server access logs for unusual patterns of administrative requests

How to Mitigate CVE-2025-28981

Immediate Actions Required

• Deactivate and remove the WP Mail Options plugin (wp-mail-options) immediately if running version 0.2.3 or earlier
• Review current plugin settings for any suspicious JavaScript code or unexpected values
• Audit all WordPress administrator accounts and remove any unauthorized users
• Check for any unfamiliar plugins that may have been installed through XSS exploitation

Patch Information

As of the current disclosure, no patch has been confirmed for this vulnerability. Users should consult the Patchstack Vulnerability Report for the latest status on available fixes. Consider using alternative WordPress mail configuration plugins that are actively maintained and have proper security controls in place.

Workarounds

• Remove the WP Mail Options plugin entirely and use WordPress core mail settings or a well-maintained alternative
• Implement a Web Application Firewall (WAF) with CSRF protection capabilities
• Restrict access to WordPress admin panel by IP address where feasible
• Educate administrators about phishing and social engineering attacks that could be used to trigger CSRF exploits

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-mail-options

# Remove the plugin files completely
wp plugin delete wp-mail-options

# Verify no unauthorized admin accounts exist
wp user list --role=administrator