CVE-2025-32664 Overview
CVE-2025-32664 is a Cross-Site Request Forgery (CSRF) vulnerability in the nepali-date-utilities WordPress plugin by ashokbasnet. The flaw affects all versions up to and including 1.0.15. An attacker can chain the CSRF weakness with Stored Cross-Site Scripting (XSS) to persist malicious JavaScript in the WordPress site. Exploitation requires an authenticated administrator to visit a crafted page or link. The vulnerability is classified under CWE-352 and carries a network attack vector with low complexity.
Critical Impact
Successful exploitation allows attackers to inject persistent JavaScript into a WordPress site by tricking an administrator into visiting a malicious page, leading to session hijacking, account takeover, or further site compromise.
Affected Products
- ashokbasnet Nepali Date Utilities WordPress plugin
- All versions from initial release through 1.0.15
- WordPress installations using the nepali-date-utilities plugin
Discovery Timeline
- 2025-04-09 - CVE-2025-32664 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-32664
Vulnerability Analysis
The Nepali Date Utilities plugin exposes administrative actions without validating request authenticity. The plugin's settings or input handlers accept state-changing POST requests without verifying a WordPress nonce or origin header. This allows an attacker-controlled page to forge requests on behalf of an authenticated administrator. Because the submitted data is later rendered without proper output encoding, the CSRF flaw escalates into a Stored XSS condition. The injected payload persists in the database and executes in the browser of any user who loads the affected page.
Root Cause
The root cause is a missing CSRF token validation, categorized as [CWE-352]. The plugin relies on session cookies alone to authorize sensitive operations. Combined with insufficient input sanitization and output escaping on stored values, the request forgery becomes a vector for persistent script injection.
Attack Vector
An attacker hosts a malicious HTML page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. The attacker lures a logged-in WordPress administrator to visit the page through phishing or a watering-hole attack. The victim's browser submits the forged request with valid session cookies, writing attacker-controlled JavaScript into plugin-managed data. When any privileged user subsequently views the rendered output, the stored payload executes in the context of the WordPress origin. This enables cookie theft, administrative action hijacking, or backdoor account creation.
No public proof-of-concept exploit is currently available. Refer to the Patchstack Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-32664
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript stored in plugin-managed database tables or wp_options entries related to nepali-date-utilities.
- WordPress administrator sessions originating from unusual IP addresses or geolocations following plugin configuration changes.
- Unexplained creation of new WordPress administrator accounts or modifications to existing privileged users.
- Outbound HTTP requests from administrator browsers to unknown domains immediately after loading WordPress admin pages.
Detection Strategies
- Inspect plugin database entries for HTML or JavaScript content using queries against wp_options and any custom tables created by the plugin.
- Review web server access logs for POST requests to plugin endpoints lacking a valid Referer header from the same origin.
- Monitor WordPress audit logs for plugin setting changes that do not correlate with legitimate administrator activity.
Monitoring Recommendations
- Deploy a Web Application Firewall (WAF) ruleset that flags cross-origin POST requests to /wp-admin/ endpoints without nonces.
- Enable file integrity monitoring on the WordPress installation to detect unauthorized plugin or theme modifications.
- Configure Content Security Policy (CSP) headers and alert on CSP violation reports indicating inline script execution.
How to Mitigate CVE-2025-32664
Immediate Actions Required
- Deactivate the nepali-date-utilities plugin until a patched version is available, since all releases through 1.0.15 are affected.
- Audit plugin configuration data and database entries for injected JavaScript or HTML payloads and remove malicious content.
- Force password resets and session invalidation for all WordPress administrator accounts.
- Review recently created users and scheduled tasks (wp-cron) for unauthorized additions.
Patch Information
At the time of publication, no fixed version has been identified in the available references. The vulnerability affects Nepali Date Utilities from initial release through 1.0.15. Monitor the Patchstack Vulnerability Advisory and the plugin's WordPress.org page for an official update.
Workarounds
- Remove the plugin entirely if it is not business-critical, since no patched version is confirmed.
- Restrict access to /wp-admin/ paths using IP allowlists at the web server or WAF layer.
- Train administrators to avoid clicking untrusted links while logged into WordPress and to use separate browsers or profiles for administrative sessions.
- Enforce a strict Content Security Policy that blocks inline scripts and unauthorized external script sources.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate nepali-date-utilities
wp plugin delete nepali-date-utilities
# Force logout of all users to invalidate any hijacked sessions
wp user session destroy --all --all-users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
