CVE-2025-32922: WP2LEADS CSRF Vulnerability

CVE-2025-32922 Overview

CVE-2025-32922 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP2LEADS WordPress plugin developed by Saleswonder Team: Tobias. The flaw affects all versions of WP2LEADS up to and including 3.5.0. Successful exploitation allows an attacker to trigger Stored Cross-Site Scripting (XSS) by tricking an authenticated administrator into executing a forged request. The injected payload persists in the application and executes in the browser context of subsequent visitors. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).

Critical Impact
An attacker can chain CSRF with Stored XSS to execute arbitrary JavaScript in administrator sessions, leading to account takeover, content tampering, and persistent compromise of affected WordPress sites.

Affected Products

WP2LEADS plugin for WordPress, versions up to and including 3.5.0
Vendor: Saleswonder Team: Tobias
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-05-15 - CVE-2025-32922 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32922

Vulnerability Analysis

The vulnerability combines two weaknesses into one attack chain. The plugin processes state-changing requests without validating an anti-CSRF token, and it stores user-supplied input that is later rendered without proper output encoding. An attacker hosts a malicious page containing a crafted form or script targeting a WP2LEADS endpoint. When an authenticated WordPress administrator visits that page, the browser submits the request using the admin's existing session cookies. The plugin accepts the forged request and persists the attacker-controlled payload in the database.

When any user, including other administrators, later views the affected page, the stored payload executes as JavaScript in their browser. This can result in session theft, privilege escalation through administrator action forgery, and persistent backdoors via plugin or theme manipulation. User interaction is required, which is consistent with CSRF exploitation patterns.

Root Cause

The root cause is the absence of WordPress nonce verification (wp_verify_nonce or check_admin_referer) on plugin endpoints that accept input. Compounding the issue, stored values are not sanitized with functions such as wp_kses_post or escaped on output with esc_html or esc_attr. This dual failure transforms a single CSRF into a Stored XSS primitive.

Attack Vector

Exploitation occurs remotely over the network. The attacker delivers a malicious URL or embeds an auto-submitting form on an attacker-controlled site. Social engineering, such as a phishing email directed at a site administrator, triggers the forged request. The vulnerability requires the victim to be authenticated to the target WordPress instance at the time of interaction. No additional privileges are required by the attacker.

No public proof-of-concept exploit code is currently available. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-32922

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript payloads stored in WP2LEADS plugin data tables
WordPress administrator accounts created or modified without a corresponding audit trail
Outbound requests from administrator browsers to unknown domains following access to WP2LEADS admin pages
Modifications to themes, plugins, or wp_options entries shortly after an administrator visited an external link

Detection Strategies

Review WordPress database tables associated with WP2LEADS for HTML or JavaScript content in fields expected to contain plain text
Inspect web server access logs for POST requests to WP2LEADS endpoints lacking a same-origin Referer header
Deploy a Web Application Firewall (WAF) rule set that flags requests missing valid WordPress nonce parameters
Audit administrator session activity for actions performed immediately after navigation from external referrers

Monitoring Recommendations

Enable WordPress activity logging to capture plugin configuration changes and content modifications
Forward web server and WordPress application logs to a centralized SIEM for correlation and retention
Monitor for the installation of unfamiliar plugins or admin user creation events outside of change windows
Alert on Content Security Policy (CSP) violations reported by browsers when visiting WordPress admin pages

How to Mitigate CVE-2025-32922

Immediate Actions Required

Identify all WordPress instances running WP2LEADS version 3.5.0 or earlier and prioritize them for patching
Disable or remove the WP2LEADS plugin until a fixed version is installed if the plugin is not business-critical
Force a password reset and invalidate active sessions for all WordPress administrator accounts
Audit the WordPress database and plugin storage for previously injected XSS payloads and remove them

Patch Information

At the time of publication, the NVD record does not list a fixed version. Site owners should monitor the Patchstack Vulnerability Advisory and the official WordPress plugin repository for an updated release beyond version 3.5.0. Apply the patched version as soon as it becomes available.

Workarounds

Restrict access to WordPress administration pages by source IP address using web server or firewall rules
Deploy a WAF with rules to block requests to WP2LEADS endpoints that lack valid WordPress nonces
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution
Instruct administrators to log out of WordPress when not actively performing administrative tasks

bash

# Example Apache configuration to restrict wp-admin to trusted IPs
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
    Require ip 198.51.100.42
</Directory>

# Example nginx Content-Security-Policy header for wp-admin
location /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;
}