CVE-2025-7688: Add User Meta WordPress Plugin CSRF Flaw

CVE-2025-7688 Overview

CVE-2025-7688 is a Cross-Site Request Forgery (CSRF) vulnerability in the Add User Meta plugin for WordPress. The flaw affects all versions up to and including 1.0.1. The plugin fails to implement proper nonce validation on the add-user-meta administrative page. Unauthenticated attackers can craft forged requests that update plugin settings and inject malicious web scripts. Exploitation requires social engineering: an attacker must trick an authenticated site administrator into clicking a crafted link or visiting an attacker-controlled page. The issue is tracked under CWE-352 (Cross-Site Request Forgery).

Critical Impact
A successful attack allows unauthenticated actors to modify plugin settings and inject stored scripts into the WordPress admin interface, leading to persistent Cross-Site Scripting (XSS) against site administrators.

Affected Products

WordPress Add User Meta plugin, all versions through 1.0.1
WordPress sites with the plugin installed and active
Administrator sessions on affected WordPress instances

Discovery Timeline

2025-08-15 - CVE-2025-7688 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7688

Vulnerability Analysis

The vulnerability resides in the request handler responsible for processing submissions on the add-user-meta settings page. WordPress provides a nonce mechanism (wp_nonce_field and check_admin_referer) to bind state-changing requests to an authenticated session. The plugin either omits this check or implements it incorrectly. As a result, the server accepts any well-formed POST request that arrives with a valid administrator cookie, regardless of origin. Attackers combine the CSRF primitive with unsanitized input fields to write attacker-controlled script content into stored settings. When an administrator later views the affected page, the injected script executes in the administrator's browser context.

Root Cause

The root cause is missing or improperly validated CSRF tokens on the add-user-meta page handler. Without a same-origin nonce check, the plugin cannot distinguish between an intentional administrative submission and a forged cross-origin request that rides on the administrator's session cookie.

Attack Vector

An attacker hosts a page containing an auto-submitting form or crafted image tag that targets the vulnerable plugin endpoint. The attacker delivers the link through phishing, forum posts, or comments. When a logged-in administrator visits the page, the browser attaches session cookies and the plugin processes the forged request. The injected payload persists in plugin settings and executes on subsequent admin page loads. Because no code examples are published in a verified proof-of-concept repository, refer to the Wordfence Vulnerability Analysis and WordPress Plugin Code for source-level details.

Detection Methods for CVE-2025-7688

Indicators of Compromise

Unexpected outbound HTTP referrers in WordPress access logs pointing to the add-user-meta admin page from third-party domains
Unauthorized modifications to plugin settings or user meta records without a corresponding admin audit entry
Presence of <script> tags, onerror=, or javascript: URIs in Add User Meta plugin configuration values
Administrator sessions initiating settings changes immediately after visiting external links

Detection Strategies

Inspect WordPress access logs for POST requests to admin.php?page=add-user-meta that lack a valid _wpnonce parameter
Compare stored plugin option values against known-good baselines to identify injected markup
Monitor browser Content Security Policy (CSP) violation reports for inline script execution within /wp-admin/ pages
Alert on administrator account activity that follows navigation from untrusted external referrers

Monitoring Recommendations

Enable WordPress activity logging plugins to record all option and user meta changes with source IP and referrer
Forward WordPress and web server logs to a centralized SIEM for correlation with authentication events
Track file integrity of plugin directories under wp-content/plugins/add-user-meta/ to detect tampering
Review administrator login patterns for anomalous geolocations or user agents preceding settings changes

How to Mitigate CVE-2025-7688

Immediate Actions Required

Deactivate and remove the Add User Meta plugin until a patched version is released by the maintainer
Audit the WordPress wp_options and wp_usermeta tables for injected script content and remove malicious values
Rotate administrator passwords and invalidate active sessions using wp_logout_url or a session management plugin
Restrict /wp-admin/ access to trusted IP ranges through web server or WAF rules

Patch Information

No patched version of the Add User Meta plugin is referenced in the available advisory data. Site operators should monitor the WordPress Add User Meta Plugin page and the Wordfence Vulnerability Analysis for release announcements. Until a fix is published, uninstalling the plugin is the recommended action.

Workarounds

Remove the plugin entirely if it is not business-critical, as it has no active patch
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the add-user-meta page lacking a valid _wpnonce parameter
Enforce administrator use of dedicated browsers or browser profiles that do not visit untrusted content
Apply a strict Content Security Policy for /wp-admin/ to limit inline script execution

bash

# Example WAF rule (ModSecurity) to block CSRF against the vulnerable endpoint
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1007688,phase:2,deny,status:403,\
     msg:'CVE-2025-7688 CSRF attempt against Add User Meta plugin'"
    SecRule REQUEST_URI "@contains page=add-user-meta" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"