CVE-2025-32485: WP Performance Pack CSRF Vulnerability

CVE-2025-32485 Overview

CVE-2025-32485 is a Cross-Site Request Forgery (CSRF) vulnerability in the Bjoern WP Performance Pack plugin for WordPress. The flaw affects all versions of wp-performance-pack up to and including 2.5.4. The vulnerability is classified under [CWE-352] and stems from missing or insufficient anti-CSRF token validation on privileged plugin actions.

An attacker can trick an authenticated WordPress user into visiting a crafted page. The browser then submits a forged request to the vulnerable plugin endpoint, executing actions with the victim's privileges. Exploitation requires user interaction but no authentication on the attacker's side.

Critical Impact
An attacker can coerce an authenticated WordPress user into performing unintended state-changing actions on the WP Performance Pack plugin, affecting integrity of plugin configuration.

Affected Products

Bjoern WP Performance Pack plugin for WordPress
All versions from n/a through 2.5.4 inclusive
WordPress sites with wp-performance-pack installed and activated

Discovery Timeline

2025-04-09 - CVE-2025-32485 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32485

Vulnerability Analysis

The WP Performance Pack plugin exposes administrative or state-changing endpoints without adequate Cross-Site Request Forgery protection. WordPress plugins typically defend such endpoints with nonces validated via check_admin_referer() or wp_verify_nonce(). The absence or misuse of these controls allows a third-party site to submit forged requests through the victim's authenticated session.

The attack vector is network-based and requires user interaction, meaning the target must be logged into WordPress and visit an attacker-controlled page. The impact is limited to integrity, with no direct effect on confidentiality or availability of the WordPress site. EPSS data places the exploitation probability at 0.197% as of the latest scoring.

Root Cause

The root cause is missing CSRF token validation on one or more plugin request handlers in wp-performance-pack versions through 2.5.4. Without a nonce check tied to the user session, the server cannot distinguish a legitimate administrative request from a forged cross-origin submission.

Attack Vector

An attacker hosts a page containing a hidden form or JavaScript that targets the vulnerable plugin endpoint on a WordPress site. When an authenticated user, typically an administrator, visits the attacker's page, the browser attaches WordPress session cookies to the forged request. The plugin processes the request as if it were legitimate, modifying settings or invoking privileged actions.

Exploitation techniques include hidden iframes, auto-submitting HTML forms, and image tags referencing state-changing URLs. Social engineering, such as phishing emails linking to the attacker's page, is the typical delivery method. Refer to the Patchstack Advisory for further technical details.

Detection Methods for CVE-2025-32485

Indicators of Compromise

Unexpected modifications to WP Performance Pack plugin settings without a corresponding administrator action in the audit log.
HTTP POST or GET requests to plugin endpoints containing an external Referer header not matching the WordPress admin origin.
Requests to plugin action URLs missing the standard _wpnonce parameter.

Detection Strategies

Inspect WordPress access logs for cross-origin Referer values targeting wp-admin endpoints tied to wp-performance-pack.
Review plugin configuration history and correlate changes against known administrator login sessions.
Deploy a Web Application Firewall rule that flags requests to plugin endpoints lacking a valid WordPress nonce token.

Monitoring Recommendations

Enable WordPress audit logging plugins to record all administrative configuration changes with user attribution.
Alert on outbound browsing by administrator accounts to untrusted domains during active admin sessions.
Monitor for anomalous plugin option updates in the wp_options table via database activity monitoring.

How to Mitigate CVE-2025-32485

Immediate Actions Required

Update WP Performance Pack to a version later than 2.5.4 once the vendor publishes a fix, or deactivate the plugin.
Restrict WordPress administrator accounts to dedicated browsers or sessions not used for general web browsing.
Require administrators to log out of WordPress when not actively managing the site.

Patch Information

At the time of the NVD entry, no fixed version beyond 2.5.4 is referenced in the advisory. Consult the Patchstack Advisory for the latest patch status and upgrade guidance from the plugin author.

Workarounds

Deactivate and remove the wp-performance-pack plugin until a patched release is available.
Deploy a WordPress-aware Web Application Firewall to block cross-origin state-changing requests to plugin endpoints.
Enforce SameSite Lax or Strict cookie attributes on WordPress session cookies to limit cross-site request delivery.

bash

# Configuration example: enforce SameSite cookies via WordPress config
# Add to wp-config.php before the "stop editing" line
@ini_set('session.cookie_samesite', 'Strict');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');