CVE-2025-8383: Depicter WordPress Plugin CSRF Vulnerability

CVE-2025-8383 Overview

CVE-2025-8383 is a Cross-Site Request Forgery [CWE-352] vulnerability in the Depicter plugin for WordPress. The flaw affects all plugin versions up to and including 4.0.4. The root cause is missing or incorrect nonce validation on the depicter-document-rules-store function, which handles document rule modifications through an AJAX endpoint.

Unauthenticated attackers can forge requests that modify document rules if they trick a site administrator into clicking a malicious link or visiting a crafted page. Exploitation requires user interaction, which limits automated attack scenarios but does not eliminate risk for administrators who browse untrusted sites while authenticated.

Critical Impact
Unauthenticated attackers can alter Depicter document rules on a target WordPress site by luring an authenticated administrator into a forged request, resulting in unauthorized modification of plugin configuration.

Affected Products

Depicter plugin for WordPress, versions less than or equal to 4.0.4
WordPress sites using the vulnerable depicter-document-rules-store AJAX handler
Administrator sessions on WordPress installations with Depicter installed and active

Discovery Timeline

2025-10-31 - CVE-2025-8383 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8383

Vulnerability Analysis

The Depicter plugin exposes an AJAX action named depicter-document-rules-store that writes document rule data on behalf of authenticated administrators. WordPress plugins are expected to validate a per-session nonce on any state-changing request using functions such as check_ajax_referer() or wp_verify_nonce(). The vulnerable code path in app/routes/ajax.php either omits this check or performs it incorrectly.

Without a valid nonce check, the endpoint accepts any request that carries the administrator's authentication cookies. A browser will attach those cookies automatically when the admin loads a third-party page that issues a request to the target site. This is the classic precondition for CSRF against a WordPress admin action.

The practical outcome is limited to integrity impact on the document rules stored by the plugin. Confidentiality and availability are not directly affected. Successful modification of document rules can, however, alter how content is served to site visitors, depending on how the administrator uses the plugin.

Root Cause

The root cause is missing or incorrect nonce validation on a privileged AJAX handler. The plugin trusts the ambient authentication provided by the WordPress session cookie without verifying that the request originated from the WordPress admin UI. This violates the WordPress security model, which requires nonce verification on all state-changing requests to defend against cross-origin forgery.

Attack Vector

An attacker hosts a page containing an auto-submitting form or JavaScript fetch() call that targets the vulnerable AJAX endpoint on the victim WordPress site. The attacker sends the page URL to a Depicter administrator through phishing, a forum post, or a chat message. When the administrator loads the page while logged into WordPress, the browser attaches the session cookie and the request executes with administrator privileges. The endpoint writes attacker-supplied document rule data because no nonce is validated.

See the WordPress Plugin Code Reference for the specific handler and the CleanTalk CVE-2025-8383 Analysis for exploitation context.

Detection Methods for CVE-2025-8383

Indicators of Compromise

POST requests to admin-ajax.php with the action parameter set to depicter-document-rules-store and a Referer header pointing to an external domain
Unexpected modifications to Depicter document rules that do not correlate with administrator activity in the WordPress audit log
Administrator sessions issuing plugin-configuration requests immediately after clicking external links or opening email attachments

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin-ajax.php containing action=depicter-document-rules-store and correlate the Referer against the site's own origin
Enable WordPress audit logging plugins to record changes to Depicter configuration and flag off-hours or anomalous edits
Monitor outbound email and chat gateways for links that target the WordPress admin interface with pre-built query strings

Monitoring Recommendations

Alert on any state-changing AJAX action originating from a cross-site Referer or lacking the X-Requested-With: XMLHttpRequest header
Track administrator user-agent and IP fingerprints for sudden context switches that coincide with plugin configuration changes
Feed WordPress and web server logs into a centralized analytics platform so CSRF patterns across multiple sites can be correlated

How to Mitigate CVE-2025-8383

Immediate Actions Required

Update the Depicter plugin to the version released after 4.0.4 that addresses WordPress Changeset #3384613
Review Depicter document rules for unauthorized changes and restore known-good configuration from backup if tampering is suspected
Require administrators to log out of WordPress before browsing untrusted content and to use dedicated browsers or profiles for admin work

Patch Information

The maintainers of Depicter published a fix in WordPress Changeset #3384613. The patch adds nonce validation to the depicter-document-rules-store handler so that requests without a valid WordPress nonce are rejected. Refer to the Wordfence Vulnerability Report for the fixed version range.

Workarounds

Deactivate the Depicter plugin until the patched version is installed if immediate updating is not possible
Restrict access to wp-admin/admin-ajax.php at the web application firewall by requiring a same-origin Referer for the depicter-document-rules-store action
Enforce SameSite=Lax or SameSite=Strict on WordPress session cookies to reduce cross-origin cookie attachment

bash

# Example WAF rule (ModSecurity) to block cross-origin CSRF on the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1008383,msg:'Blocked cross-origin Depicter rules-store request'"
SecRule ARGS:action "@streq depicter-document-rules-store" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"