CVE-2025-32678: WP Show Stats CSRF Vulnerability

CVE-2025-32678 Overview

CVE-2025-32678 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Show Stats WordPress plugin developed by Ashish Ajani. The flaw affects all versions of the plugin up to and including 1.5. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, performs unauthorized state-changing actions on the WordPress site. The vulnerability is categorized under [CWE-352], indicating missing or insufficient anti-CSRF protections such as nonce validation on sensitive plugin endpoints.

Critical Impact
Authenticated WordPress users can be tricked into executing unintended plugin actions, resulting in limited integrity impact on affected sites running WP Show Stats 1.5 or earlier.

Affected Products

Ashish Ajani WP Show Stats plugin for WordPress
WP Show Stats versions from n/a through 1.5
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-04-09 - CVE-2025-32678 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32678

Vulnerability Analysis

The WP Show Stats plugin exposes one or more administrative actions that perform state-changing operations without validating the origin of the request. The plugin does not enforce WordPress nonce checks using functions such as wp_verify_nonce() or check_admin_referer() on these endpoints. As a result, an attacker who lures an authenticated WordPress user to a malicious page can trigger requests that modify plugin state under the victim's session.

The attack requires user interaction, typically clicking a link or loading an attacker-controlled page while logged in to WordPress. Successful exploitation results in a low integrity impact, with no direct effect on confidentiality or availability. The vulnerability is exploitable over the network without prior authentication on the attacker's side, since the victim's browser supplies session cookies automatically.

Root Cause

The root cause is the absence of anti-CSRF tokens on sensitive plugin actions. WordPress provides a nonce framework specifically designed to prevent this class of issue, and the plugin fails to use it consistently on request handlers that alter configuration or data.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker hosts a page containing an HTML form or JavaScript that submits a crafted request to the target WordPress site. When a logged-in administrator or privileged user visits the page, the browser sends the request with valid session cookies, and the plugin processes it as legitimate.

No verified public exploit code is available for CVE-2025-32678. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-32678

Indicators of Compromise

Unexpected changes to WP Show Stats plugin configuration or stored data on WordPress sites
HTTP POST or GET requests to plugin endpoints originating from external Referer headers
WordPress access logs showing plugin action requests without a corresponding admin panel navigation trail

Detection Strategies

Inspect web server access logs for requests to WP Show Stats plugin URLs where the Referer header does not match the site's own domain
Monitor for requests to plugin action handlers that lack a valid _wpnonce parameter
Correlate authenticated administrator sessions with unusual outbound referrers immediately preceding plugin state changes

Monitoring Recommendations

Enable WordPress audit logging plugins to capture plugin configuration changes with user, IP, and referrer context
Alert on any modification to WP Show Stats settings until the plugin is patched or removed
Review browser and endpoint telemetry for administrators who received phishing links directing them to WordPress admin URLs

How to Mitigate CVE-2025-32678

Immediate Actions Required

Identify all WordPress sites running WP Show Stats version 1.5 or earlier and prioritize them for remediation
Deactivate and uninstall the WP Show Stats plugin if a patched version is not yet available for your installation
Instruct WordPress administrators to log out of admin sessions when not actively managing the site

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry for CVE-2025-32678. Monitor the Patchstack advisory and the plugin's WordPress.org page for an official update. Apply the patched release immediately upon availability.

Workarounds

Remove the WP Show Stats plugin from production sites until a vendor patch is released
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin endpoints lacking a valid same-origin Referer header
Restrict WordPress administrator access to trusted networks using IP allowlists on /wp-admin/
Require administrators to use isolated browser profiles or dedicated management workstations to reduce cross-site exposure

bash

# Example: disable the plugin via WP-CLI until a patched version is available
wp plugin deactivate wp-show-stats
wp plugin uninstall wp-show-stats