CVE-2025-7684 Overview
CVE-2025-7684 is a Cross-Site Request Forgery (CSRF) vulnerability in the Last.fm Recent Album Artwork plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.2. It stems from missing or incorrect nonce validation on the lastfm_albums_artwork.php page. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. Successful exploitation combines CSRF with stored script injection, allowing attacker-controlled content to persist in the WordPress site configuration. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Attackers can hijack administrator sessions through forged requests to modify plugin settings and inject persistent scripts into affected WordPress sites.
Affected Products
- Last.fm Recent Album Artwork plugin for WordPress — all versions through 1.0.2
- WordPress sites with the plugin installed and activated
- Site administrators authenticated to the WordPress admin panel
Discovery Timeline
- 2025-08-16 - CVE-2025-7684 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7684
Vulnerability Analysis
The Last.fm Recent Album Artwork plugin processes settings updates through lastfm_albums_artwork.php without verifying a valid WordPress nonce. WordPress uses nonces as anti-CSRF tokens to confirm that administrative requests originate from legitimate user actions. When the token check is missing or incorrect, any cross-origin request submitted by an authenticated administrator is accepted as valid. An attacker hosting a malicious page can auto-submit a form or issue a crafted request to the plugin endpoint. If an administrator visits the attacker page while logged in to WordPress, the browser attaches session cookies and the plugin executes the change. Attackers then insert JavaScript payloads into settings fields that render in the admin dashboard or on public pages.
Root Cause
The plugin fails to call wp_verify_nonce() or check_admin_referer() on the settings handler in lastfm_albums_artwork.php. Without this validation, WordPress cannot distinguish forged submissions from legitimate administrator actions.
Attack Vector
Exploitation is network-based and requires user interaction. The attacker must lure an authenticated WordPress administrator to a controlled URL. The forged request updates plugin settings and stores attacker-supplied script content, which executes when the modified settings are rendered. Review the plugin source on WordPress Trac and the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-7684
Indicators of Compromise
- Unexpected changes to Last.fm Recent Album Artwork plugin settings in wp_options or plugin-specific rows
- Presence of <script> tags or inline JavaScript in plugin configuration values
- Administrator sessions with referer headers pointing to unfamiliar external domains immediately before setting changes
- POST requests to lastfm_albums_artwork.php lacking _wpnonce parameters
Detection Strategies
- Monitor WordPress audit logs for plugin settings modifications correlated with external referers
- Inspect stored plugin option values for HTML or JavaScript content that should not be present
- Alert on administrator requests to the plugin settings endpoint originating from cross-origin contexts
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track option and settings updates
- Deploy a web application firewall (WAF) with rules for CSRF and stored XSS patterns targeting WordPress plugins
- Review web server access logs for POST requests to plugin PHP files from unauthenticated sources
How to Mitigate CVE-2025-7684
Immediate Actions Required
- Deactivate and remove the Last.fm Recent Album Artwork plugin until a patched release is available
- Audit plugin settings for injected script content and revert unauthorized changes
- Force password resets and session invalidation for WordPress administrator accounts
- Restrict administrative access using IP allowlists or multi-factor authentication
Patch Information
At the time of the last NVD update, no fixed version of the plugin has been published. Monitor the WordPress Plugin Repository for updates and apply any released patch immediately.
Workarounds
- Remove the plugin from production WordPress installations
- Deploy a WAF rule blocking requests to lastfm_albums_artwork.php that lack a valid WordPress nonce
- Enforce SameSite=Strict cookies for the WordPress admin session to reduce CSRF exposure
- Train administrators to log out of WordPress before browsing untrusted links
# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate lastfm-recent-album-artwork
wp plugin delete lastfm-recent-album-artwork
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
