CVE-2025-5937: Videowhisper Micropayments CSRF Vulnerability

CVE-2025-5937 Overview

CVE-2025-5937 affects the MicroPayments – Fans Paysite plugin for WordPress, developed by videowhisper. The plugin, which supports paid creator subscriptions, digital assets, and wallet functionality, contains a Cross-Site Request Forgery (CSRF) flaw in all versions up to and including 3.2.0. The adminOptions() function lacks proper nonce validation, allowing unauthenticated attackers to reset plugin settings by tricking a site administrator into clicking a crafted link. Exploitation requires user interaction from a privileged user but no attacker authentication.

Critical Impact
An unauthenticated attacker can reset the MicroPayments plugin configuration on any affected WordPress site if a site administrator can be lured to a malicious page.

Affected Products

Videowhisper MicroPayments plugin for WordPress — all versions ≤ 3.2.0
WordPress sites using the paid-membership plugin package from videowhisper
Sites where administrators are authenticated while browsing untrusted content

Discovery Timeline

2025-06-28 - CVE-2025-5937 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5937

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness classified under [CWE-352]. WordPress relies on nonce tokens to bind sensitive state-changing requests to an authenticated session. The MicroPayments plugin's adminOptions() handler processes administrative setting updates without verifying a valid nonce. As a result, a browser session belonging to a logged-in administrator will execute the request as-authorized when directed to a malicious URL or form. The attacker does not need credentials, only the ability to lure the administrator to attacker-controlled content.

Root Cause

The root cause is missing or incorrect nonce validation on the adminOptions() function inside the plugin's inc/options.php file. Without a call to check_admin_referer() or wp_verify_nonce() against a request token, WordPress cannot distinguish between an intentional admin action and a cross-origin forged request. The fix was introduced in the plugin repository under changeset 3318389, which adds the missing nonce enforcement.

Attack Vector

An attacker crafts a malicious page containing an auto-submitting form or image tag that targets the plugin's admin settings endpoint on a victim site. The attacker delivers the link through phishing, comment spam, or a compromised third-party site. When an authenticated WordPress administrator visits the page in the same browser, the request is issued with valid session cookies. The handler processes the request and resets the plugin's settings. While the direct impact is limited to configuration reset, disrupting payment and subscription settings can cause service disruption and secondary business impact for creator sites.

No public proof-of-concept exploit code has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-5937

Indicators of Compromise

Unexpected reset of MicroPayments plugin settings, including wallet, subscription, or payment gateway configuration values reverting to defaults
WordPress access logs showing POST requests to the plugin's admin options endpoint originating from external Referer headers
Administrator browsing history containing links to unfamiliar external domains immediately preceding a settings change

Detection Strategies

Monitor WordPress wp-admin request logs for state-changing POST requests to plugin option endpoints that lack a matching _wpnonce parameter
Alert on administrative configuration changes to the MicroPayments plugin outside scheduled maintenance windows
Correlate administrator authentication events with subsequent plugin option modifications to identify anomalous timing

Monitoring Recommendations

Enable WordPress audit logging plugins to record option table changes with user, timestamp, and source IP attribution
Track HTTP Referer values on administrative POST requests and flag cross-origin submissions
Review web application firewall telemetry for requests targeting /wp-admin/admin.php?page= handlers associated with the paid-membership plugin

How to Mitigate CVE-2025-5937

Immediate Actions Required

Update the MicroPayments – Fans Paysite plugin to the version released after changeset 3318389, which is the version above 3.2.0
Audit current plugin settings against a known-good baseline and restore any values that appear to have been reset
Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to use a dedicated browser profile for administrative work

Patch Information

The vendor addressed the issue in the plugin repository via WordPress Changeset 3318389, which introduces nonce validation on the adminOptions() function. Technical details of the vulnerable code path are available in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Workarounds

Deactivate the MicroPayments plugin until the patched version can be deployed if it is not actively required
Deploy a web application firewall rule that blocks POST requests to the plugin's admin endpoints when the Referer header is missing or points to an external origin
Restrict administrator access to the WordPress dashboard using IP allowlisting to reduce exposure to cross-site request forgery from external browsing sessions

bash

# Example WAF rule concept blocking cross-origin POSTs to the plugin settings endpoint
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1005937,msg:'Block cross-origin POST to MicroPayments admin'"
SecRule REQUEST_URI "@contains /wp-admin/admin.php" "chain"
SecRule ARGS:page "@contains paid-membership" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"