CVE-2025-3097: wp Time Machine Plugin CSRF Vulnerability

CVE-2025-3097 Overview

CVE-2025-3097 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the wp Time Machine plugin for WordPress in all versions up to and including 3.4.0. The flaw stems from missing or incorrect nonce validation on the wpTimeMachineCore.php page. Unauthenticated attackers can update plugin settings and inject malicious web scripts through forged requests. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. The vulnerability is categorized under [CWE-79] due to the resulting stored script injection potential.

Critical Impact
Successful exploitation allows attackers to modify plugin configuration and inject arbitrary JavaScript into a WordPress site by leveraging an authenticated administrator's session.

Affected Products

wp Time Machine plugin for WordPress (all versions ≤ 3.4.0)
WordPress installations running the vulnerable plugin
Sites where administrators can be socially engineered into clicking attacker-supplied links

Discovery Timeline

2025-04-02 - CVE-2025-3097 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3097

Vulnerability Analysis

The wp Time Machine plugin fails to enforce nonce validation on state-changing requests handled by wpTimeMachineCore.php. WordPress uses nonces to verify that requests originate from the intended user interface rather than a forged cross-origin source. Without this check, any authenticated administrator visiting an attacker-controlled resource can unknowingly submit configuration changes to the plugin. The forged request executes with the administrator's privileges and can modify persistent plugin settings that render in the WordPress admin interface. Because the injected values are later rendered without sufficient output encoding, the flaw combines CSRF with stored Cross-Site Scripting (XSS).

Root Cause

The root cause is missing anti-CSRF token verification in the settings handler within wpTimeMachineCore.php. WordPress provides wp_verify_nonce() and check_admin_referer() helpers for this purpose, but the vulnerable code path does not invoke them before persisting user-controllable input. This design flaw allows any origin to construct a valid state-changing request.

Attack Vector

An attacker hosts a malicious page or embeds a crafted <form> or image request pointing at the vulnerable plugin endpoint. The attacker then lures a logged-in WordPress administrator to interact with the resource, typically through phishing or a comment link. The victim's browser submits the request with valid session cookies, and the plugin accepts the payload. The attacker-supplied JavaScript is stored in the plugin configuration and executed in the browser of any administrator subsequently viewing the affected settings page. Detailed exploitation notes are available in the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference.

Detection Methods for CVE-2025-3097

Indicators of Compromise

Unexpected modifications to wp Time Machine plugin settings without corresponding administrator activity in audit logs
Presence of <script> tags, event handlers, or obfuscated JavaScript within plugin configuration values stored in the WordPress database
Outbound requests from administrator browsers to unfamiliar external domains following visits to the plugin settings page

Detection Strategies

Review the wp_options table and plugin-specific option keys for HTML or JavaScript payloads in fields that should contain plain text
Correlate WordPress admin session logs with referer headers to identify state-changing POST requests originating from external origins
Monitor web server access logs for requests to wpTimeMachineCore.php that lack a valid _wpnonce parameter

Monitoring Recommendations

Enable Web Application Firewall (WAF) rules that flag cross-origin POST requests to WordPress admin endpoints
Alert on plugin option changes occurring outside normal administrative maintenance windows
Track administrator browser telemetry for script execution originating from /wp-admin/ pages that reference untrusted domains

How to Mitigate CVE-2025-3097

Immediate Actions Required

Deactivate the wp Time Machine plugin until a patched release addressing CVE-2025-3097 is confirmed available on the WordPress Plugin Page
Rotate administrator credentials and invalidate active WordPress sessions for privileged users
Audit current plugin settings for any unauthorized JavaScript, HTML, or URL modifications and revert them

Patch Information

As of the last NVD update on 2026-06-17, the enriched data does not list a confirmed patched version. Administrators should monitor the WordPress Plugin Page and the Wordfence Vulnerability Analysis for updated version guidance. Apply any vendor release that introduces wp_verify_nonce() or check_admin_referer() calls to the settings handler.

Workarounds

Remove the plugin entirely if timely administrative maintenance is not possible
Restrict /wp-admin/ access to trusted IP addresses using web server access control lists
Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to limit inline script execution
Require administrators to use a dedicated browser profile with no cross-site cookies for WordPress management tasks

bash

# Example: restrict wp-admin access at the web server level (nginx)
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny  all;
    try_files $uri $uri/ /index.php?$args;
}