CVE-2026-25014: Enter Addons CSRF Vulnerability

CVE-2026-25014 Overview

CVE-2026-25014 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the themelooks Enter Addons WordPress plugin. The flaw exists in all versions up to and including 2.3.2. An attacker can craft a malicious web page that triggers unauthorized state-changing actions when an authenticated user visits it. Exploitation requires user interaction, such as clicking a link or loading attacker-controlled content. The issue is tracked under CWE-352 and was published to the National Vulnerability Database on 2026-02-03.

Critical Impact
Successful exploitation allows attackers to perform unauthorized actions in the context of an authenticated WordPress user, potentially modifying plugin data or site configuration without consent.

Affected Products

themelooks Enter Addons (enteraddons) WordPress plugin
All versions from n/a through 2.3.2
WordPress installations using the vulnerable plugin

Discovery Timeline

2026-02-03 - CVE-2026-25014 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-25014

Vulnerability Analysis

The Enter Addons plugin fails to validate the origin of state-changing HTTP requests. WordPress provides a nonce mechanism (wp_nonce_field, check_admin_referer, wp_verify_nonce) to defend against CSRF, but the affected handlers do not enforce nonce verification. An attacker who hosts a crafted page can submit forged requests using the victim's authenticated session cookies. The browser automatically attaches authentication cookies, allowing the request to execute server-side actions as the victim.

Impact is constrained to integrity, with no confidentiality or availability impact reported. The vulnerability requires user interaction, which lowers the practical exploitation rate. EPSS data places the exploitation likelihood at 0.02%, reflecting the user interaction dependency.

Root Cause

The root cause is missing or improperly implemented CSRF protection on one or more plugin endpoints. WordPress plugins must verify a nonce and the request referer before executing privileged operations. The Enter Addons plugin omits this check, accepting requests purely on the basis of session cookies.

Attack Vector

The attack vector is network-based through a web browser. An attacker creates a webpage containing an auto-submitting form or a crafted image tag pointing at a vulnerable plugin action URL. When an authenticated WordPress administrator or editor visits the attacker-controlled page, the browser issues the forged request. The plugin processes the request because it lacks anti-CSRF token validation.

No verified proof-of-concept code is publicly available. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-25014

Indicators of Compromise

Unexpected modifications to Enter Addons plugin settings or content created without corresponding admin activity
HTTP POST or GET requests to plugin endpoints lacking a valid _wpnonce parameter in web server access logs
Requests to plugin URLs with Referer headers pointing to external, untrusted domains

Detection Strategies

Review WordPress audit logs for state-changing actions originating from sessions with mismatched referer headers
Inspect web server logs for requests to wp-admin/admin-ajax.php or admin-post.php carrying action parameters tied to Enter Addons without nonce values
Correlate user-agent strings, geolocation, and session timing to identify forged request patterns

Monitoring Recommendations

Enable a WordPress activity logging plugin to record administrative actions with full request metadata
Monitor outbound traffic from administrator workstations to detect interaction with phishing or malicious sites
Alert on plugin configuration changes outside of approved maintenance windows

How to Mitigate CVE-2026-25014

Immediate Actions Required

Update Enter Addons to a version newer than 2.3.2 once the vendor publishes a patched release
Deactivate and remove the Enter Addons plugin if a fixed version is not yet available and the functionality is not essential
Instruct administrators to log out of WordPress sessions before browsing untrusted sites

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.3.2. Consult the Patchstack advisory and the themelooks vendor channels for the latest fixed version and apply it across all WordPress instances.

Workarounds

Deploy a web application firewall rule that blocks requests to Enter Addons endpoints lacking a valid _wpnonce token
Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies to limit cross-site request submission
Restrict WordPress administrative access by IP address to reduce the exposure surface for forged requests

bash

# Example NGINX rule to block plugin admin-post requests missing a nonce
location = /wp-admin/admin-post.php {
    if ($arg_action ~* "enteraddons") {
        if ($arg__wpnonce = "") { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}