CVE-2025-12028
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).
Analysis
Cross-Site Request Forgery in WordPress IndieAuth plugin (all versions ≤4.5.4) enables unauthenticated attackers to force authenticated users to authorize malicious OAuth applications, leading to account takeover with full administrative privileges (create, update, delete scopes). Missing nonce validation on login_form_indieauth() and the /wp-login.php?action=indieauth authorization endpoint allows attackers to steal authorization codes and exchange them for access tokens. CVSS 8.8 (High) with network attack vector and low complexity. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Patch released in version 4.5.5.
Technical Context
This vulnerability exploits missing CSRF token (nonce) validation in the IndieAuth plugin's OAuth 2.0 authorization flow. IndieAuth implements the IndieAuth protocol for WordPress, enabling OAuth-based authentication and authorization. The authorization endpoint at wp-login.php?action=indieauth and the login_form_indieauth() function fail to verify WordPress nonces before processing authorization approval requests. This violates the OAuth 2.0 Security Best Current Practice (RFC 8252) requirement for state parameter validation and CSRF protection in authorization flows. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a session riding attack where authenticated session cookies are automatically included in forged requests. The flaw exists in class-indieauth-authorization-endpoint.php at multiple points in the authorization approval logic, allowing attackers to bypass user consent requirements entirely.
Affected Products
WordPress IndieAuth plugin versions 4.5.4 and earlier are affected. The vulnerability exists in the class-indieauth-authorization-endpoint.php component across all historical versions up to and including 4.5.4. Specific vulnerable code paths are documented at lines 411, 418, and 476 in the 4.5.4 release available at https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php. This affects any WordPress installation running the IndieAuth plugin for OAuth-based authentication and authorization workflows. The plugin is implemented in PHP and runs within the WordPress content management system on Microsoft Windows, Linux, or other platforms supporting WordPress hosting environments.
Remediation
Update to WordPress IndieAuth plugin version 4.5.5 or later, which addresses the missing nonce validation issues. The patch implemented in changeset 3384558 is available at https://plugins.trac.wordpress.org/changeset/3384558/ and adds proper CSRF token verification to the authorization endpoint and login form handler. Site administrators should upgrade immediately through the WordPress plugin update mechanism (Dashboard → Plugins → Update). If immediate patching is not feasible, implement temporary mitigations by restricting access to the wp-login.php?action=indieauth endpoint via web application firewall rules or by disabling the IndieAuth plugin until updates can be applied. Review OAuth application authorizations and revoke any suspicious or unrecognized third-party application access tokens. Audit user sessions and force re-authentication for administrative accounts if compromise is suspected. Additional technical details and vulnerability disclosure are available at https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today