CVE-2025-2935 Overview
CVE-2025-2935 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress. The flaw impacts all plugin versions up to and including 2024.7. It stems from missing or incorrect nonce validation in the ss_option_maint.php and ss_user_filter_list.php files. Unauthenticated attackers can delete pending comments and re-enable previously blocked users by tricking a site administrator into clicking a crafted link. The weakness is classified as [CWE-352].
Critical Impact
Administrator interaction with an attacker-controlled link allows unauthenticated deletion of pending comments and reactivation of previously blocked spam users.
Affected Products
- Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress
- All versions up to and including 2024.7
- Vulnerable files: ss_option_maint.php and ss_user_filter_list.php
Discovery Timeline
- 2025-06-06 - CVE-2025-2935 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2935
Vulnerability Analysis
The plugin exposes administrative actions that lack proper WordPress nonce checks. Nonces are single-use tokens WordPress uses to validate the intent of requests. When these tokens are missing or improperly validated, the browser will submit authenticated requests using the administrator's session cookies without confirming user intent. An attacker crafts a request that reaches the vulnerable endpoints in ss_option_maint.php (line 73) and ss_user_filter_list.php (lines 239 and 447). If an administrator visits an attacker-controlled page while logged in, the browser silently issues the state-changing request.
Root Cause
The root cause is missing or incorrect nonce validation in two plugin files. The affected code paths process administrative actions without calling wp_verify_nonce() or check_admin_referer() on incoming parameters. This omission removes the anti-CSRF control WordPress provides by default for privileged actions.
Attack Vector
Exploitation requires the attacker to lure a logged-in administrator into clicking a malicious link or visiting a page containing a forged request. The request executes with the administrator's privileges. Successful exploitation permits deletion of pending comments and reactivation of users previously blocked by the anti-spam plugin. This undermines site moderation and allows previously banned spam accounts to regain access. The vulnerability requires user interaction and does not directly expose confidentiality beyond the affected moderation state. See the WordPress Plugin Code Review and WordPress Plugin User Filter Code for the vulnerable source locations.
Detection Methods for CVE-2025-2935
Indicators of Compromise
- Unexpected deletion of pending comments from the WordPress moderation queue without corresponding admin activity in audit logs.
- Previously blocked users reappearing as active accounts in the plugin's user filter list.
- HTTP referer headers on plugin admin endpoints originating from external domains rather than wp-admin.
Detection Strategies
- Review WordPress access logs for POST or GET requests to ss_option_maint.php and ss_user_filter_list.php that lack a matching nonce parameter or originate from third-party origins.
- Correlate administrator authenticated sessions with outbound clicks to unknown domains preceding moderation state changes.
- Monitor plugin configuration and user filter tables for unauthorized modifications.
Monitoring Recommendations
- Enable WordPress audit logging to record all administrative actions, including comment deletion and user unblock events.
- Alert on HTTP referer mismatches for requests targeting plugin admin endpoints.
- Track administrator browsing behavior for visits to untrusted sites while authenticated to WordPress.
How to Mitigate CVE-2025-2935
Immediate Actions Required
- Update the Anti-Spam: Spam Protection plugin to a version later than 2024.7 that includes the nonce validation fix referenced in the WordPress Plugin Change Log.
- Audit pending comments and the blocked user list for unauthorized changes since the plugin was installed.
- Instruct administrators to log out of WordPress when not actively managing the site.
Patch Information
The vendor addressed the missing nonce validation in the plugin update tracked in changeset 3377746. Refer to the Wordfence Vulnerability Report for the fixed version and validation details.
Workarounds
- Deactivate the plugin until the patched version is deployed if immediate updating is not possible.
- Restrict administrator accounts to dedicated browsers or sessions used only for WordPress administration.
- Deploy a web application firewall rule to block requests to ss_option_maint.php and ss_user_filter_list.php that lack a valid WordPress nonce parameter or a same-origin referer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
