CVE-2025-9887: WordPress Custom Login Widget CSRF Flaw

CVE-2025-9887 Overview

CVE-2025-9887 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Custom Login And Signup Widget plugin for WordPress. The flaw affects all versions up to and including 1.0. The root cause is missing or incorrect nonce validation in the /frndzk_adminclsw.php file. Unauthenticated attackers can change email and username settings by tricking a site administrator into clicking a crafted link. Exploitation requires user interaction from a privileged user but no attacker authentication.

Critical Impact
An attacker can modify the plugin's stored email and username settings by coercing an authenticated administrator into visiting an attacker-controlled page.

Affected Products

WordPress Custom Login And Signup Widget plugin — all versions through 1.0
Vulnerable file: frndzk_adminclsw.php
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-09-20 - CVE-2025-9887 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9887

Vulnerability Analysis

The Custom Login And Signup Widget plugin exposes an administrative settings handler in frndzk_adminclsw.php that processes state-changing requests without verifying a WordPress nonce. WordPress nonces are the standard defense against CSRF, binding form submissions to a specific user session. Because the handler does not call wp_verify_nonce() or check_admin_referer() before applying changes, any authenticated administrator session can be reused by a cross-origin request. An attacker only needs to host a page that auto-submits a form or triggers a request to the vulnerable endpoint. When an administrator visits the page while logged in, the browser attaches session cookies and the plugin accepts the request as legitimate.

Root Cause

The root cause is missing anti-CSRF token validation in the plugin's admin settings processor. The handler trusts the presence of an authenticated session and does not confirm that the request originated from a WordPress-generated form. This omission maps directly to [CWE-352]: Cross-Site Request Forgery.

Attack Vector

Exploitation is remote and network-based. An attacker crafts an HTML page containing a hidden form or JavaScript that issues a POST request to the plugin's admin endpoint on a target site. The attacker delivers the link through phishing, forum posts, or comments. If a logged-in administrator opens the link, the browser submits the forged request with valid session cookies, and the plugin overwrites the stored email and username values. Because the affected fields govern account identity within the plugin, an attacker can redirect notifications or disrupt legitimate administrator access. The vulnerability does not permit direct code execution or arbitrary data disclosure. See the Wordfence Vulnerability Report and the WordPress plugin source for the vulnerable handler.

Detection Methods for CVE-2025-9887

Indicators of Compromise

Unexpected changes to the plugin's stored administrator email or username values
POST requests to frndzk_adminclsw.php with Referer headers pointing to external domains
Admin-area requests lacking the WordPress _wpnonce parameter
Password reset or notification emails delivered to unfamiliar addresses after administrator browsing activity

Detection Strategies

Review web server access logs for cross-origin POST requests to plugin admin endpoints under /wp-content/plugins/custom-login-and-signup-widget/
Alert on WordPress options table changes to keys owned by the plugin, correlating timestamps with administrator sessions
Enable WordPress audit logging plugins to record settings changes and the originating user

Monitoring Recommendations

Monitor for phishing links targeting site administrators that reference WordPress admin URLs
Track outbound HTTP referrers in administrator browser sessions using endpoint telemetry
Baseline the frequency of plugin configuration updates and alert on off-hours modifications

How to Mitigate CVE-2025-9887

Immediate Actions Required

Deactivate and remove the Custom Login And Signup Widget plugin until a patched version is available
Audit the plugin's stored email and username settings and restore known-good values
Require administrators to log out of the WordPress admin before browsing untrusted sites
Enforce multi-factor authentication on all administrator accounts to limit downstream abuse

Patch Information

No vendor patch is listed in the CVE record at time of publication. The vulnerability affects all versions through 1.0 of the Custom Login And Signup Widget plugin. Monitor the WordPress plugin repository and the Wordfence advisory for a fixed release that adds wp_verify_nonce() checks to frndzk_adminclsw.php.

Workarounds

Block direct access to frndzk_adminclsw.php at the web server or Web Application Firewall (WAF) layer for requests without a valid same-origin Referer
Restrict WordPress admin (/wp-admin/) access by source IP address using web server rules
Replace the plugin with an actively maintained alternative that implements CSRF protection
Configure the site to set SameSite=Lax or SameSite=Strict on authentication cookies to limit cross-site cookie transmission

bash

# Example nginx rule to block external POSTs to the vulnerable handler
location ~ /wp-content/plugins/custom-login-and-signup-widget/frndzk_adminclsw\.php$ {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-domain\.com/") {
            return 403;
        }
    }
}