CVE-2025-31888: WP Multistore Locator CSRF Vulnerability

CVE-2025-31888 Overview

CVE-2025-31888 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WPExperts.io WP Multistore Locator plugin for WordPress. The flaw exists in all plugin versions up to and including 2.5.2. Attackers can trick authenticated users into submitting unintended requests to the vulnerable application by luring them to a malicious page. The issue is categorized under CWE-352 and requires user interaction to succeed. Successful exploitation results in limited integrity impact on the affected WordPress instance.

Critical Impact
An attacker can coerce an authenticated WordPress user into performing state-changing actions within the WP Multistore Locator plugin without their knowledge or consent.

Affected Products

WPExperts.io WP Multistore Locator (wp-multi-store-locator)
All versions from n/a through 2.5.2
WordPress installations with the plugin enabled

Discovery Timeline

2025-04-01 - CVE-2025-31888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31888

Vulnerability Analysis

The vulnerability stems from missing or improper anti-CSRF token validation in the WP Multistore Locator plugin. State-changing operations exposed by the plugin do not verify the origin or authenticity of incoming requests. An attacker who convinces a logged-in WordPress user to visit an attacker-controlled page can trigger requests that the plugin processes as if they came from the legitimate user. The EPSS score is 0.145%, indicating low near-term exploitation likelihood, though the risk remains relevant for sites running the affected plugin version. This class of flaw is tracked under CWE-352: Cross-Site Request Forgery.

Root Cause

The root cause is the absence of proper WordPress nonce validation on plugin actions. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to protect against CSRF, and the plugin fails to enforce these checks on sensitive endpoints. Without a validated nonce tied to the user's session, the server cannot distinguish forged requests from legitimate ones.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious HTML page containing an auto-submitting form or image tag targeting a vulnerable plugin endpoint. When an authenticated WordPress administrator or privileged user visits the page, their browser automatically submits the forged request along with valid session cookies. The plugin processes the request and applies the attacker-controlled changes. Full technical details are available in the Patchstack CSRF Vulnerability Report.

Detection Methods for CVE-2025-31888

Indicators of Compromise

Unexpected modifications to WP Multistore Locator plugin settings or store entries without corresponding admin login events
HTTP POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains
Admin session activity originating from unusual IP addresses immediately following user browsing activity

Detection Strategies

Inspect WordPress access logs for requests to wp-multi-store-locator action handlers that lack a valid _wpnonce parameter
Correlate plugin configuration changes with authenticated user sessions to identify actions performed without direct admin interaction
Deploy a Web Application Firewall (WAF) rule that flags cross-origin requests to WordPress admin endpoints

Monitoring Recommendations

Enable WordPress audit logging to capture all plugin option changes and administrative actions
Monitor referrer headers on requests to /wp-admin/admin.php and /wp-admin/admin-post.php endpoints tied to the plugin
Alert on the installation of any plugin version at or below 2.5.2 across managed WordPress fleets

How to Mitigate CVE-2025-31888

Immediate Actions Required

Identify all WordPress instances running WP Multistore Locator version 2.5.2 or earlier
Update the plugin to a version above 2.5.2 once a patched release is available from WPExperts.io
Restrict administrator browsing to trusted destinations while logged into WordPress admin sessions
Enforce strong session policies including short session lifetimes and re-authentication for sensitive actions

Patch Information

At the time of publication, the vulnerability affects WP Multistore Locator through version 2.5.2. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest patched version.

Workarounds

Deactivate and remove the WP Multistore Locator plugin until a fixed release is installed
Deploy a WAF rule requiring a same-origin Referer or Origin header on plugin state-changing requests
Apply the SameSite=Strict attribute to WordPress authentication cookies to limit cross-site cookie transmission
Limit administrator accounts and require multi-factor authentication to reduce the pool of exploitable sessions

bash

# Example: identify vulnerable plugin version via WP-CLI
wp plugin get wp-multi-store-locator --field=version

# Deactivate the plugin as an interim workaround
wp plugin deactivate wp-multi-store-locator