CVE-2025-31906: WP Profitshare CSRF Vulnerability

CVE-2025-31906 Overview

CVE-2025-31906 is a Cross-Site Request Forgery (CSRF) vulnerability in the ProfitShare.ro WP Profitshare plugin for WordPress. The flaw affects all versions up to and including 1.4.9. Successful exploitation allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), persisting malicious JavaScript in the WordPress administrative context.

The weakness is tracked under CWE-352: Cross-Site Request Forgery. Exploitation requires an authenticated administrator to visit an attacker-controlled page while logged into WordPress.

Critical Impact
An attacker who tricks an authenticated administrator into visiting a malicious page can persist arbitrary JavaScript in the WordPress site, leading to session theft, account takeover, and further compromise.

Affected Products

ProfitShare.ro WP Profitshare plugin for WordPress
All versions from n/a through 1.4.9
WordPress sites with the WP Profitshare plugin installed and active

Discovery Timeline

2025-04-01 - CVE-2025-31906 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31906

Vulnerability Analysis

The WP Profitshare plugin fails to validate the origin of state-changing requests. Administrative actions that modify plugin settings do not verify a WordPress nonce or equivalent anti-CSRF token. An attacker can craft a forged request that, when submitted by an authenticated administrator's browser, injects attacker-controlled content into plugin configuration fields.

Because the injected values are later rendered without sufficient output encoding, the CSRF flaw escalates into Stored XSS [CWE-79]. The persisted script executes in the browser of any user who loads the affected page. This combination is significant because a single successful social engineering attempt yields long-lived JavaScript execution in the WordPress dashboard context.

The attack requires user interaction from a privileged victim. No prior authentication on the attacker's part is required. Scope is changed because the injected script can act under a different security context than the initial vulnerable endpoint.

Root Cause

The root cause is the absence of CSRF protection on plugin endpoints that accept and persist user-supplied input. WordPress provides wp_nonce_field() and check_admin_referer() to mitigate this class of issue. The vulnerable versions of WP Profitshare do not consistently apply these primitives on settings handlers, and they also omit sanitization through functions such as sanitize_text_field() and contextual escaping with esc_attr() or esc_html() on output.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or fetch() call that targets the vulnerable plugin endpoint on a victim WordPress site. The attacker then lures an authenticated WordPress administrator to the page through phishing, a forum link, or a compromised third-party site. The victim's browser submits the request with valid session cookies, and the plugin stores the attacker's payload. Subsequent page loads execute the injected JavaScript in the administrator's browser session.

No verified public exploit code is available. Technical detail is documented in the Patchstack WP Profitshare advisory.

Detection Methods for CVE-2025-31906

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URIs stored in WP Profitshare plugin configuration values in the wp_options table.
WordPress access logs showing POST requests to WP Profitshare admin endpoints with Referer headers pointing to external or unrelated domains.
New or modified administrator accounts and unexpected outbound requests from the WordPress admin browser session.

Detection Strategies

Audit the wp_options table for plugin keys associated with wp-profitshare and flag values containing HTML or script syntax.
Inspect WordPress access logs for state-changing requests to wp-admin/admin.php or admin-post.php actions tied to WP Profitshare that lack a valid _wpnonce parameter.
Use a web application firewall to log and alert on cross-origin POST requests targeting WordPress administrative paths.

Monitoring Recommendations

Monitor administrator browser sessions for anomalous JavaScript execution and outbound XHR or fetch calls originating from wp-admin pages.
Track plugin version inventories across WordPress estates and alert when wp-profitshare versions less than or equal to 1.4.9 are detected.
Centralize WordPress and reverse proxy logs and apply detection rules for repeated cross-origin POST patterns against plugin endpoints.

How to Mitigate CVE-2025-31906

Immediate Actions Required

Identify all WordPress sites running the WP Profitshare plugin and confirm the installed version.
Deactivate the WP Profitshare plugin on any site running version 1.4.9 or earlier until a patched release is verified.
Review plugin settings and remove any stored values containing script tags, event handlers, or external URLs that were not configured by an administrator.
Force password resets and session invalidation for WordPress administrators who may have accessed the affected admin pages during the exposure window.

Patch Information

At the time of this writing, the Patchstack advisory identifies all versions up to and including 1.4.9 as affected. Administrators should consult the vendor and Patchstack listings for a fixed release and upgrade once available. If no patched version is published, removing the plugin is the recommended path.

Workarounds

Restrict access to wp-admin paths by IP allowlist at the web server or WAF layer to reduce exposure to forged cross-origin requests.
Deploy a web application firewall rule that blocks state-changing requests to WP Profitshare endpoints lacking a same-origin Referer and a valid _wpnonce parameter.
Enforce a strict Content Security Policy on the WordPress admin interface to limit execution of injected inline scripts.

bash

# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-profitshare
wp plugin delete wp-profitshare

# Example: audit options table for suspicious stored values
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%profitshare%';"