CVE-2025-49284: WP Maintenance Mode CSRF Vulnerability

CVE-2025-49284 Overview

CVE-2025-49284 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Maintenance Mode & Site Under Construction WordPress plugin from wp-buy. The flaw impacts all plugin versions up to and including 4.3. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, performs unintended state-changing actions on the target WordPress site. The vulnerability is classified under CWE-352 and requires user interaction to succeed.

Critical Impact
An attacker can trick a logged-in administrator into performing unauthorized plugin configuration changes on a WordPress site running a vulnerable version of the maintenance mode plugin.

Affected Products

WP Maintenance Mode & Site Under Construction plugin versions up to and including 4.3
Plugin slug: wp-maintenance-mode-site-under-construction
Vendor: wp-buy

Discovery Timeline

2025-06-06 - CVE-2025-49284 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49284

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protections on state-changing endpoints exposed by the WP Maintenance Mode & Site Under Construction plugin. WordPress plugins are expected to validate a nonce token with functions such as wp_verify_nonce() or check_admin_referer() on every action that alters server state. When these validations are missing, the browser of an authenticated administrator will automatically attach session cookies to any request sent to the site, allowing an attacker-controlled origin to submit forged requests on behalf of the victim.

The attack is network-reachable and does not require attacker authentication. However, the victim must be logged in as a privileged WordPress user and must be lured into visiting or interacting with attacker-controlled content. Successful exploitation results in limited integrity impact with no direct impact on confidentiality or availability.

Root Cause

The root cause is the absence of anti-CSRF token verification on one or more privileged plugin actions. Without a nonce check, the plugin cannot distinguish a legitimate administrator-initiated request from a forged request originating from an external site. This is a classic implementation of CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation typically involves an attacker hosting a page containing an auto-submitting HTML form or JavaScript-triggered request targeting the vulnerable plugin endpoint. When a WordPress administrator with an active session visits the malicious page, the browser transmits the request to the target site with valid authentication cookies. The plugin processes the request as legitimate and applies the attacker-specified changes to the maintenance mode configuration.

For technical specifics on the vulnerable endpoint, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-49284

Indicators of Compromise

Unexpected changes to the maintenance mode configuration, such as toggled active state or altered page content, without corresponding administrator activity in audit logs.
HTTP POST requests to plugin administrative endpoints where the Referer header points to an external, untrusted domain.
Administrator sessions generating plugin configuration changes shortly after visiting external links or webmail messages.

Detection Strategies

Inspect web server access logs for requests to wp-admin endpoints associated with the wp-maintenance-mode-site-under-construction plugin that lack a matching same-origin Referer or Origin header.
Enable WordPress audit logging plugins to record every plugin settings change with user, timestamp, and source IP.
Correlate administrator browser activity with configuration change events to identify forged actions.

Monitoring Recommendations

Alert on any administrator-level plugin configuration change occurring outside of approved maintenance windows.
Monitor for browser-driven requests originating from suspicious Referer values against the WordPress admin surface.
Track the installed version of the wp-maintenance-mode-site-under-construction plugin across all managed WordPress instances to identify unpatched deployments.

How to Mitigate CVE-2025-49284

Immediate Actions Required

Identify all WordPress installations running WP Maintenance Mode & Site Under Construction version 4.3 or earlier.
Update the plugin to a fixed version once released by wp-buy, or disable and remove the plugin if a patch is not yet available.
Instruct administrators to log out of WordPress before browsing untrusted sites and to avoid clicking unsolicited links while authenticated.

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 4.3 as affected. Administrators should monitor the plugin repository for a release above 4.3 that introduces wp_verify_nonce() checks on the impacted actions and apply it promptly.

Workarounds

Deploy a Web Application Firewall (WAF) rule that requires a valid same-origin Referer or Origin header on POST requests to plugin admin endpoints.
Restrict access to the WordPress wp-admin directory by source IP address where feasible.
Enforce short administrator session lifetimes and require re-authentication for sensitive actions to reduce the exploitation window.

bash

# Example nginx rule enforcing same-origin submissions to wp-admin
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $ok 0;
        if ($http_origin ~* ^https?://your-site\.example$) { set $ok 1; }
        if ($http_referer ~* ^https?://your-site\.example/) { set $ok 1; }
        if ($ok = 0) { return 403; }
    }
}