CVE-2025-9945: Optimize More! CSS Plugin CSRF Vulnerability

CVE-2025-9945 Overview

CVE-2025-9945 is a Cross-Site Request Forgery (CSRF) vulnerability in the Optimize More! – CSS plugin for WordPress. The flaw affects all versions up to and including 1.0.3. The vulnerability stems from missing or incorrect nonce validation on the reset_plugin function in Settings.php. Unauthenticated attackers can reset the plugin's optimization settings by tricking a site administrator into clicking a crafted link. The issue is tracked under [CWE-352] Cross-Site Request Forgery.

Critical Impact
Successful exploitation resets the plugin configuration, disrupting site optimization settings and requiring administrator re-configuration.

Affected Products

Optimize More! – CSS plugin for WordPress
All versions up to and including 1.0.3
WordPress sites with the plugin installed and an active administrator session

Discovery Timeline

2025-10-03 - CVE-2025-9945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9945

Vulnerability Analysis

The vulnerability exists in the reset_plugin handler within the plugin's Settings.php file. WordPress provides a nonce mechanism to validate that state-changing requests originate from legitimate user actions. The Optimize More! – CSS plugin either omits nonce verification entirely or implements it incorrectly on the reset endpoint. This allows an attacker to construct a request that, when executed in the browser of an authenticated administrator, performs the reset action without consent.

The attack does not require the attacker to have credentials on the target site. It requires user interaction — the administrator must be logged in and must load attacker-controlled content, such as clicking a link or visiting a page containing an automated form submission.

The impact is limited to integrity of the plugin's configuration. No confidentiality or availability impact is directly caused by the reset action, though loss of optimization settings can degrade site performance until settings are restored.

Root Cause

The root cause is missing or incorrect use of WordPress nonce validation, typically implemented with wp_verify_nonce() or check_admin_referer(). Without this check, the plugin cannot distinguish between requests initiated intentionally by the administrator and forged requests triggered from a third-party origin. Reference the WordPress Plugin Code Review for the specific code path.

Attack Vector

An attacker hosts a malicious page containing a hidden form or JavaScript that submits a request to the vulnerable reset_plugin endpoint on the target WordPress site. The attacker lures an authenticated administrator to the page through phishing or social engineering. The browser attaches the administrator's session cookies to the outbound request, and the plugin processes the reset action as if the administrator had initiated it. The Wordfence Vulnerability Report documents the exploitation pattern.

Detection Methods for CVE-2025-9945

Indicators of Compromise

Unexpected reset of Optimize More! – CSS plugin optimization settings in the WordPress admin dashboard
HTTP POST or GET requests to the plugin's settings reset endpoint originating from external Referer headers
Administrator session activity immediately following clicks on external links or emails

Detection Strategies

Review WordPress access logs for requests to admin.php or admin-ajax.php targeting the Optimize More! – CSS plugin with off-site Referer values
Monitor plugin settings tables in the WordPress database for unexpected changes to the optimize-more-css option keys
Correlate administrator login sessions with subsequent configuration change events to identify anomalous timing

Monitoring Recommendations

Enable audit logging for WordPress administrative actions using a security plugin or SIEM integration
Alert on any modification to plugin configuration outside of scheduled maintenance windows
Track outbound clicks and phishing indicators in email gateways that could deliver CSRF lure links to administrators

How to Mitigate CVE-2025-9945

Immediate Actions Required

Update the Optimize More! – CSS plugin to a patched version once released by the vendor
If no patch is available, deactivate and remove the plugin from production WordPress sites
Instruct administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates on a patched release.

Workarounds

Restrict administrator access to WordPress from dedicated browser profiles that do not visit untrusted sites
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's reset endpoint lacking a valid Referer header from the same origin
Enforce SameSite cookie attributes on WordPress session cookies to limit cross-origin request execution

bash

# Example WAF rule concept (ModSecurity-style) to block cross-origin reset requests
SecRule REQUEST_URI "@contains optimize-more-css" \
    "chain,deny,status:403,id:1009945,msg:'Block CSRF against Optimize More CSS reset_plugin'"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"