CVE-2025-32563: WP Calais Auto Tagger CSRF Vulnerability

CVE-2025-32563 Overview

CVE-2025-32563 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Calais Auto Tagger WordPress plugin developed by dangrossman. The flaw exists in calais-auto-tagger versions up to and including 2.0. According to the Patchstack Vulnerability Report, the CSRF condition can be chained to achieve stored Cross-Site Scripting (XSS). The vulnerability is classified under [CWE-352] Cross-Site Request Forgery and requires user interaction to trigger.

Critical Impact

An attacker can trick an authenticated WordPress administrator into submitting a forged request that injects persistent malicious JavaScript into the site, leading to stored XSS execution in administrator and visitor browsers.

Affected Products

• dangrossman WP Calais Auto Tagger plugin for WordPress
• All versions from n/a through <= 2.0
• WordPress installations with calais-auto-tagger enabled

Discovery Timeline

• 2025-04-09 - CVE-2025-32563 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32563

Vulnerability Analysis

The WP Calais Auto Tagger plugin fails to validate the origin of state-changing HTTP requests submitted to its administrative endpoints. The plugin lacks anti-CSRF nonce verification on functions that accept user input and persist it to the WordPress database. An attacker who lures an authenticated administrator to a malicious page can force the victim's browser to issue a forged request. Because the plugin does not sanitize or escape the submitted content, the request stores attacker-controlled JavaScript in plugin-managed fields, producing a stored XSS condition. Execution context inside the WordPress administrative dashboard enables follow-on actions including account takeover, plugin tampering, and pivoting toward server-side code execution.

Root Cause

The root cause is the absence of wp_verify_nonce() validation and capability checks on settings handlers within the plugin. WordPress provides built-in nonce primitives such as wp_nonce_field() and check_admin_referer(), but calais-auto-tagger versions through 2.0 do not enforce these controls. The missing CSRF token allows cross-origin form submissions to mutate plugin state on behalf of any authenticated user with access to the affected screen.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page containing an auto-submitting form or hidden image targeting the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the attacker page, the browser submits the request with valid session cookies. The payload is stored persistently and rendered to subsequent visitors, executing JavaScript in their session context. No credentials are required by the attacker, only successful social engineering of a privileged victim. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32563

Indicators of Compromise

• Unexpected <script> tags or JavaScript event handlers stored in plugin configuration fields or post metadata managed by calais-auto-tagger.
• WordPress access logs showing POST requests to plugin administrative endpoints with Referer headers pointing to external domains.
• New or modified administrator accounts created shortly after a privileged user visited an untrusted site.

Detection Strategies

• Inspect plugin settings pages and stored tag content for HTML or JavaScript characters that should be encoded.
• Audit web server logs for state-changing requests to calais-auto-tagger paths missing valid _wpnonce parameters.
• Deploy Content Security Policy (CSP) reporting to surface unexpected inline script execution inside /wp-admin/.

Monitoring Recommendations

• Enable WordPress audit logging to record administrative configuration changes and correlate them with user session origins.
• Monitor browser network telemetry from administrator workstations for cross-origin form submissions targeting WordPress endpoints.
• Alert on anomalous outbound traffic from visitor browsers that may indicate stored XSS payloads beaconing to attacker infrastructure.

How to Mitigate CVE-2025-32563

Immediate Actions Required

• Deactivate and remove the WP Calais Auto Tagger plugin from any WordPress installation until a patched release is verified.
• Review plugin-managed content and settings for injected scripts and remove malicious payloads.
• Force password resets and session invalidation for all WordPress administrators if compromise is suspected.

Patch Information

At the time of NVD publication, no fixed version has been listed for the calais-auto-tagger plugin. The vulnerability affects versions through <= 2.0. Administrators should consult the Patchstack Vulnerability Report for the latest remediation status and replace the plugin with an actively maintained alternative if no patch is available.

Workarounds

• Restrict access to the WordPress admin dashboard using IP allowlisting at the web server or WAF layer.
• Require administrators to use separate browser profiles or dedicated browsers for WordPress management to limit CSRF exposure.
• Deploy a web application firewall rule that blocks requests to calais-auto-tagger endpoints lacking a same-origin Referer and a valid _wpnonce token.

# Example WAF rule: block cross-origin POSTs to the vulnerable plugin
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1032563,msg:'CVE-2025-32563 CSRF block'"
SecRule REQUEST_URI "@contains /wp-admin/" \
  "chain"
SecRule ARGS_NAMES "@contains calais" \
  "chain"
SecRule &REQUEST_HEADERS:Referer "@eq 0"