CVE-2025-3867 Overview
CVE-2025-3867 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax Comment Form CST plugin for WordPress. The flaw affects all versions up to and including 1.2. It stems from missing or incorrect nonce validation on the acform_cst_settings page. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking an administrator into clicking a crafted link. The vulnerability combines CSRF with Stored Cross-Site Scripting [CWE-79], enabling script execution in an administrator's browser session.
Critical Impact
Successful exploitation allows attackers to modify plugin settings and persist malicious JavaScript that executes in administrator sessions, potentially leading to site compromise.
Affected Products
- Ajax Comment Form CST plugin for WordPress
- All versions up to and including 1.2
- WordPress sites with the plugin activated
Discovery Timeline
- 2025-04-25 - CVE-2025-3867 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3867
Vulnerability Analysis
The Ajax Comment Form CST plugin exposes an administrative settings page identified as acform_cst_settings. This page processes state-changing requests without properly verifying a WordPress nonce. Nonces are the standard WordPress mechanism for preventing CSRF by binding a request to an authenticated session. Because validation is missing or incorrect, the plugin accepts settings updates from any origin, provided the request carries the administrator's authentication cookies.
An attacker chains the CSRF flaw with script injection [CWE-79]. Settings fields written by the forged request are later rendered without adequate output encoding. Any JavaScript injected through the settings becomes stored content that executes in the administrator's browser on subsequent page loads.
Root Cause
The root cause is the absence of a valid nonce check on the acform_cst_settings handler. WordPress plugins are expected to call check_admin_referer() or wp_verify_nonce() on privileged actions. The plugin either omits this check or implements it incorrectly, leaving the settings endpoint accessible via forged requests.
Attack Vector
Exploitation requires user interaction from a logged-in administrator. The attacker hosts a malicious page containing an auto-submitting form or crafted link targeting the plugin's settings endpoint. When the administrator visits the attacker-controlled resource, their browser transmits the request along with valid session cookies. The plugin processes the request and stores attacker-controlled JavaScript payloads. See the Wordfence Vulnerability Report for additional technical detail.
// No verified proof-of-concept code is available for CVE-2025-3867.
// The vulnerability mechanism is described in prose above.
Detection Methods for CVE-2025-3867
Indicators of Compromise
- Unexpected modifications to Ajax Comment Form CST plugin settings in the WordPress database (wp_options table entries related to acform_cst).
- Presence of <script> tags, event handlers, or JavaScript payloads within plugin configuration values.
- Administrator sessions loading unfamiliar external scripts when viewing comment forms or plugin settings pages.
Detection Strategies
- Audit installed WordPress plugins and flag any instance of Ajax Comment Form CST at version 1.2 or below.
- Inspect HTTP referrers on POST requests to the plugin's admin endpoints to identify cross-origin submissions.
- Review web server logs for administrator requests to admin.php?page=acform_cst_settings originating from external referrers.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress wp-content/plugins/ajax-comment-form-cst/ directory.
- Log and alert on changes to plugin option rows in the database.
- Deploy a web application firewall rule that enforces same-origin referrer checks on WordPress admin POST requests.
How to Mitigate CVE-2025-3867
Immediate Actions Required
- Deactivate the Ajax Comment Form CST plugin until a patched release is available.
- Rotate administrator credentials and invalidate active sessions if compromise is suspected.
- Scan the site for injected scripts in stored plugin settings and remove malicious payloads.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Consult the WordPress plugin page for update availability and the Wordfence Vulnerability Report for remediation status.
Workarounds
- Remove the plugin entirely if a patched version is not available.
- Restrict WordPress admin access to trusted IP addresses via web server or firewall rules.
- Require administrators to use a dedicated browser profile that does not visit untrusted sites during authenticated sessions.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate ajax-comment-form-cst
wp plugin delete ajax-comment-form-cst
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
