CVE-2025-64357: Advanced Database Cleaner CSRF Vulnerability

CVE-2025-64357 Overview

CVE-2025-64357 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Advanced Database Cleaner WordPress plugin developed by Younes JFR. The flaw affects all versions of the plugin up to and including 3.1.6. Attackers can trick authenticated users into performing unintended state-changing actions on the plugin by visiting a malicious page. Exploitation requires user interaction but no privileges on the target site. The issue is tracked in the Patchstack CSRF Vulnerability Report.

Critical Impact
Successful exploitation allows an attacker to invoke privileged plugin actions on behalf of an authenticated WordPress user, potentially altering or removing database entries managed by the plugin.

Affected Products

Younes JFR Advanced Database Cleaner WordPress plugin
All versions from initial release through 3.1.6
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-10-31 - CVE-2025-64357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64357

Vulnerability Analysis

The Advanced Database Cleaner plugin exposes administrative actions that modify server-side state without validating the origin of the request. The plugin does not enforce anti-CSRF tokens (WordPress nonces) or equivalent origin checks on all sensitive endpoints. As a result, an attacker who can lure an authenticated administrator to a controlled web page can trigger plugin actions using the victim's session cookies. The impact scope is limited to integrity: an attacker can cause the plugin to perform unwanted operations, but confidentiality and availability are not directly affected according to the published CVSS metrics.

Root Cause

The root cause is missing or insufficient CSRF protection [CWE-352] on plugin request handlers. WordPress provides wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, and the vulnerable handlers in versions up to 3.1.6 do not validate these tokens before executing privileged operations. Session cookies attached automatically by the browser are sufficient to authenticate forged requests.

Attack Vector

An attacker crafts a malicious HTML page containing a form or image tag that issues a request to the target WordPress site's plugin endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the request with valid session cookies. The plugin processes the request as legitimate. Exploitation is network-based and requires the victim to interact with the malicious content, such as clicking a link or loading a page.

No verified public exploit code is available. Refer to the Patchstack CSRF Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2025-64357

Indicators of Compromise

Unexpected database cleanup or optimization events initiated outside scheduled maintenance windows.
WordPress access logs showing POST requests to Advanced Database Cleaner endpoints with Referer headers pointing to external, untrusted domains.
Administrator sessions issuing plugin state-changing requests immediately after visiting unrelated third-party sites.

Detection Strategies

Inspect WordPress web server logs for requests to the plugin's admin action handlers that carry off-site or missing Referer headers.
Correlate authenticated administrator browsing activity with plugin state changes to identify anomalous request chains.
Monitor the wp_options table and plugin-managed schedules for modifications not tied to a legitimate admin UI session.

Monitoring Recommendations

Enable verbose logging in the WordPress admin plane and forward events to a centralized logging platform for review.
Alert on plugin-triggered destructive operations, including bulk deletions of revisions, transients, or orphaned metadata.
Track WordPress plugin version inventory and flag any site still running Advanced Database Cleaner 3.1.6 or earlier.

How to Mitigate CVE-2025-64357

Immediate Actions Required

Update the Advanced Database Cleaner plugin to a version later than 3.1.6 as soon as the vendor publishes a fixed release.
Deactivate and remove the plugin if a patched version is not yet available and the functionality is not essential.
Require administrators to log out of WordPress before browsing untrusted sites and to use separate browser profiles for admin work.

Patch Information

At the time of publication, the vulnerability affects versions through 3.1.6. Consult the Patchstack advisory for the latest fixed version information and apply updates through the WordPress plugin management console.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to plugin admin endpoints when the Referer or Origin header is missing or external.
Restrict access to /wp-admin/ by IP allowlist so that plugin action endpoints are unreachable from arbitrary networks.
Enforce short administrator session lifetimes and require reauthentication before performing sensitive plugin operations.

bash

# Example nginx snippet to block cross-origin admin POST requests
location ~ ^/wp-admin/admin\.php$ {
    if ($request_method = POST) {
        set $csrf_block "0";
        if ($http_origin !~* "^https?://your-site\.example$") { set $csrf_block "1"; }
        if ($http_referer !~* "^https?://your-site\.example/") { set $csrf_block "${csrf_block}1"; }
        if ($csrf_block ~ "11") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}