What is the CVSS score of CVE-2025-12028?

CVE-2025-12028 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-12028?

CVE-2025-12028 is a critical cross-site request forgery vulnerability in WordPress IndieAuth plugin versions 4.5.4 and earlier that allows unauthenticated attackers to hijack authenticated…

How to fix or mitigate CVE-2025-12028?

Within 24 hours: Inventory all WordPress installations using IndieAuth plugin and document current versions. Within 7 days: Update IndieAuth plugin to version 4.5.5 or later on all affected systems; if unable to patch immediately, disable the plugin and restrict /wp-login.php access by IP or disable OAuth functionality. Within 30 days: Conduct access log review for suspicious authorization requests; rotate administrator credentials; review OAuth application authorizations and revoke any unauthorized integrations.

PHP CVE-2025-12028

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-24 security@wordfence.com

WordPress Microsoft CSRF PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 24, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the login_form_indieauth() function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).

AnalysisAI

Cross-Site Request Forgery in WordPress IndieAuth plugin (all versions ≤4.5.4) enables unauthenticated attackers to force authenticated users to authorize malicious OAuth applications, leading to account takeover with full administrative privileges (create, update, delete scopes). Missing nonce validation on login_form_indieauth() and the /wp-login.php?action=indieauth authorization endpoint allows attackers to steal authorization codes and exchange them for access tokens. CVSS 8.8 (High) with network attack vector and low complexity. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Patch released in version 4.5.5.

Technical ContextAI

This vulnerability exploits missing CSRF token (nonce) validation in the IndieAuth plugin's OAuth 2.0 authorization flow. IndieAuth implements the IndieAuth protocol for WordPress, enabling OAuth-based authentication and authorization. The authorization endpoint at wp-login.php?action=indieauth and the login_form_indieauth() function fail to verify WordPress nonces before processing authorization approval requests. This violates the OAuth 2.0 Security Best Current Practice (RFC 8252) requirement for state parameter validation and CSRF protection in authorization flows. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a session riding attack where authenticated session cookies are automatically included in forged requests. The flaw exists in class-indieauth-authorization-endpoint.php at multiple points in the authorization approval logic, allowing attackers to bypass user consent requirements entirely.

Affected ProductsAI

WordPress IndieAuth plugin versions 4.5.4 and earlier are affected. The vulnerability exists in the class-indieauth-authorization-endpoint.php component across all historical versions up to and including 4.5.4. Specific vulnerable code paths are documented at lines 411, 418, and 476 in the 4.5.4 release available at https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php. This affects any WordPress installation running the IndieAuth plugin for OAuth-based authentication and authorization workflows. The plugin is implemented in PHP and runs within the WordPress content management system on Microsoft Windows, Linux, or other platforms supporting WordPress hosting environments.

RemediationAI

Update to WordPress IndieAuth plugin version 4.5.5 or later, which addresses the missing nonce validation issues. The patch implemented in changeset 3384558 is available at https://plugins.trac.wordpress.org/changeset/3384558/ and adds proper CSRF token verification to the authorization endpoint and login form handler. Site administrators should upgrade immediately through the WordPress plugin update mechanism (Dashboard → Plugins → Update). If immediate patching is not feasible, implement temporary mitigations by restricting access to the wp-login.php?action=indieauth endpoint via web application firewall rules or by disabling the IndieAuth plugin until updates can be applied. Review OAuth application authorizations and revoke any suspicious or unrecognized third-party application access tokens. Audit user sessions and force re-authentication for administrative accounts if compromise is suspected. Additional technical details and vulnerability disclosure are available at https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve.