CVE-2025-9885: MPWizard WordPress Plugin CSRF Vulnerability

CVE-2025-9885 Overview

CVE-2025-9885 is a Cross-Site Request Forgery (CSRF) vulnerability in the MPWizard – Create Mercado Pago Payment Links plugin for WordPress. The flaw affects all versions up to and including 1.2.1. The plugin fails to implement proper nonce validation in the /includes/admin/class-mpwizard-table.php file. Unauthenticated attackers can exploit this weakness to delete arbitrary posts on affected sites. Successful exploitation requires tricking an authenticated administrator into clicking a malicious link or visiting an attacker-controlled page. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Unauthenticated attackers can delete arbitrary WordPress posts by tricking an administrator into visiting a crafted link, resulting in content loss and integrity impact.

Affected Products

MPWizard – Create Mercado Pago Payment Links plugin for WordPress
All versions up to and including 1.2.1
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-10-03 - CVE-2025-9885 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9885

Vulnerability Analysis

The MPWizard plugin exposes an administrative action that lacks proper Cross-Site Request Forgery protections. WordPress provides a nonce mechanism through functions such as wp_create_nonce() and check_admin_referer() to bind administrative actions to a specific user session. The plugin either omits this validation or implements it incorrectly in class-mpwizard-table.php around line 157.

Because the deletion endpoint does not verify the origin of the incoming request, any HTTP request reaching the endpoint with a valid administrator session cookie is honored. An attacker can craft a page that issues this request when an administrator visits it. The result is deletion of arbitrary posts without the administrator's intent.

The vulnerability is limited to integrity impact. It does not disclose data or crash the site. However, silent removal of published content can disrupt commerce workflows tied to Mercado Pago payment links.

Root Cause

The root cause is missing or incorrect nonce validation in the post deletion routine within /includes/admin/class-mpwizard-table.php. WordPress plugins are expected to validate a nonce token on every state-changing administrative action. The affected code path processes deletion requests without confirming that the request originated from a legitimate plugin interface interaction.

Attack Vector

An attacker hosts a page containing a hidden form or image tag that issues a GET or POST request to the vulnerable MPWizard admin endpoint. The attacker delivers the link through phishing, comment injection, or social channels. When a logged-in WordPress administrator loads the attacker's page, the browser attaches the administrator's session cookies to the outbound request. The server processes the deletion because no nonce verification blocks the forged request.

Exploitation requires user interaction from an authenticated administrator. No credentials or prior access are needed by the attacker.

Refer to the WordPress Code Reference and the Wordfence Vulnerability Report for the exact vulnerable code path.

Detection Methods for CVE-2025-9885

Indicators of Compromise

Unexpected deletion events in the WordPress wp_posts table or audit logs, particularly with no corresponding user-initiated action in the admin UI
HTTP requests to MPWizard admin endpoints with Referer headers pointing to external or unknown domains
Administrator browser sessions loading suspicious external pages shortly before post deletion events
Presence of the MPWizard plugin at version 1.2.1 or earlier on the WordPress installation

Detection Strategies

Enable WordPress audit logging to capture post deletion events with associated user, IP, and referrer metadata
Correlate web server access logs for admin-ajax or plugin admin URLs against outbound referrers that are not the site's own domain
Monitor for administrator sessions performing deletion actions immediately after browsing external content
Use file integrity monitoring on the wp-content/plugins/mpwizard/ directory to confirm installed version

Monitoring Recommendations

Alert on any bulk or unusual post.deleted events tied to administrator accounts
Track requests to /wp-admin/ endpoints originating from cross-origin referrers
Review WordPress site health reports and plugin inventory for the vulnerable version 1.2.1

How to Mitigate CVE-2025-9885

Immediate Actions Required

Update the MPWizard – Create Mercado Pago Payment Links plugin to a version newer than 1.2.1 once a patched release is available
Deactivate and remove the plugin if a fixed release is not yet published and the payment link functionality is not business-critical
Restrict administrator browsing habits and enforce separate accounts for content administration versus general web use
Review recent post deletions and restore from backup if unauthorized removals are identified

Patch Information

At the time of the last NVD update on 2026-06-17, the vendor advisory referenced through the Wordfence Vulnerability Report should be consulted for the current patched version. Administrators should apply the fixed release as soon as it is published to the WordPress plugin repository.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to MPWizard admin endpoints lacking a valid same-origin Referer or Origin header
Enforce the SameSite=Lax or SameSite=Strict attribute on WordPress session cookies to reduce cross-site request risk
Limit administrator accounts to dedicated browsers or browser profiles that are not used for general web browsing
Require multi-factor authentication for administrator logins to reduce the value of hijacked sessions

bash

# Example WAF rule concept (ModSecurity) to require same-origin referrer on MPWizard admin actions
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
  "chain,phase:1,deny,status:403,id:1009885,msg:'Block cross-origin MPWizard admin request'"
    SecRule ARGS:page "@rx ^mpwizard" "chain"
        SecRule &REQUEST_HEADERS:Referer "@eq 0"