CVE-2025-5924: WP Firebase Push Notification CSRF Flaw

CVE-2025-5924 Overview

CVE-2025-5924 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Firebase Push Notification plugin for WordPress. The flaw affects all versions up to and including 1.2.0. It stems from missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. Unauthenticated attackers can send broadcast notifications through forged requests if they trick a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352 and requires user interaction to succeed. Successful exploitation allows attackers to abuse the push notification channel of the target WordPress site.

Critical Impact
Unauthenticated attackers can send arbitrary broadcast push notifications to a site's subscribers by tricking an administrator into clicking a malicious link.

Affected Products

Skywavesolutions WP Firebase Push Notification plugin for WordPress
All versions up to and including 1.2.0
WordPress sites using the wp-push-notification-firebase plugin

Discovery Timeline

2025-07-04 - CVE-2025-5924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5924

Vulnerability Analysis

The vulnerability exists in the wfpn_brodcast_notification_message() function of the WP Firebase Push Notification plugin. The function processes broadcast notification requests without properly validating a WordPress nonce. WordPress nonces are the standard defense against CSRF attacks, and their absence allows external sites to trigger authenticated actions.

An attacker crafts a malicious page or link containing a forged request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled resource, the browser automatically includes the administrator's session cookies. The plugin processes the request as legitimate because it never verifies the origin of the submission.

The result is an unauthorized broadcast push notification sent through the site's Firebase Cloud Messaging integration. Attackers can use this channel to distribute phishing messages, malicious URLs, or disinformation to all subscribers. The impact scope depends on the size and trust of the site's notification audience.

Root Cause

The root cause is the omission of WordPress nonce checks such as check_admin_referer() or wp_verify_nonce() before executing the broadcast handler. Without this validation, the plugin cannot distinguish between a legitimate administrator submission and a forged cross-site request. This is a textbook CWE-352 failure to enforce state-changing request authenticity.

Attack Vector

Exploitation requires social engineering. The attacker hosts a page with a form or JavaScript that auto-submits a request to the target site's wfpn_brodcast_notification_message() endpoint. The attacker then lures a WordPress administrator into visiting the page while authenticated. See the WordPress Plugin Source Code for the vulnerable handler and the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-5924

Indicators of Compromise

Unexpected broadcast push notifications sent from the WordPress site outside of scheduled campaigns
HTTP POST requests to the plugin's broadcast endpoint with Referer headers pointing to external domains
Administrator sessions generating notification actions immediately after visiting untrusted links
Firebase Cloud Messaging logs showing broadcast payloads not initiated from the WordPress admin dashboard

Detection Strategies

Review WordPress access logs for POST requests to admin-ajax.php or plugin endpoints invoking wfpn_brodcast_notification_message with external referrers
Correlate administrator browser activity with notification broadcast timestamps to identify anomalous triggers
Monitor Firebase FCM message logs for content, timing, or recipient patterns inconsistent with authorized campaigns

Monitoring Recommendations

Enable WordPress audit logging plugins to record administrative actions and originating request metadata
Alert on outbound push notification volume spikes or off-hours broadcast activity
Track plugin version inventory across managed WordPress sites to identify hosts still running 1.2.0 or earlier

How to Mitigate CVE-2025-5924

Immediate Actions Required

Deactivate the WP Firebase Push Notification plugin on any site running version 1.2.0 or earlier until a patched release is confirmed
Instruct WordPress administrators to log out of the admin panel before browsing untrusted sites and to use dedicated administration browsers
Rotate Firebase Cloud Messaging server keys if unauthorized broadcasts are suspected

Patch Information

At the time of the latest NVD update, no vendor-supplied patched version was listed in the enriched data. Monitor the WordPress plugin repository and the Wordfence advisory for updated release information. Apply the fixed version as soon as the vendor publishes it.

Workarounds

Restrict administrator access to the WordPress dashboard using IP allowlisting or VPN-only access to reduce CSRF exposure
Deploy a Web Application Firewall (WAF) rule that requires a valid Referer or origin header matching the WordPress site for requests to the broadcast endpoint
Uninstall the plugin if push notifications are non-essential to site operations

bash

# Example nginx rule to block external referers on the vulnerable endpoint
location ~* /wp-admin/admin-ajax.php {
    if ($http_referer !~* "^https?://your-site\.example/") {
        return 403;
    }
}