CVE-2025-12028

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12028", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-21T15:30:05.581Z", "datePublished": "2025-10-24T08:23:58.518Z", "dateUpdated": "2026-04-08T16:48:58.505Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:58.505Z"}, "affected": [{"vendor": "indieweb", "product": "IndieAuth", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.5.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete)."}], "title": "IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476"}, {"url": "https://plugins.trac.wordpress.org/changeset/3384558/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-23T19:57:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T12:12:28.148278Z", "id": "CVE-2025-12028", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:31:06.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12028", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-24T12:12:28.148278Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T12:12:28.881Z"}}], "cna": {"title": "IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "indieweb", "product": "IndieAuth", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.5.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-23T19:57:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418"}, {"url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476"}, {"url": "https://plugins.trac.wordpress.org/changeset/3384558/"}], "descriptions": [{"lang": "en", "value": "The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:58.505Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12028", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:58.505Z", "dateReserved": "2025-10-21T15:30:05.581Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-24T08:23:58.518Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "IndieAuth", "vendor": "indieweb", "versions": [{"lessThanOrEqual": "4.5.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete)."}, {"lang": "es", "value": "El plugin IndieAuth para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 4.5.4, inclusive. Esto se debe a la falta de verificaci\u00f3n de nonce en la funci\u00f3n 'login_form_indieauth()' y el endpoint de autorizaci\u00f3n en wp-login.php?action=indieauth. Esto hace posible que atacantes no autenticados fuercen a usuarios autenticados a aprobar solicitudes de autorizaci\u00f3n OAuth para aplicaciones controladas por el atacante a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace o visitar una p\u00e1gina maliciosa mientras est\u00e1 conectado. El atacante puede entonces intercambiar el c\u00f3digo de autorizaci\u00f3n robado por un token de acceso, tomando efectivamente el control de la cuenta de la v\u00edctima con los alcances concedidos (crear, actualizar, eliminar)."}], "id": "CVE-2025-12028", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12028", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-24T12:12:28.148278Z", "version": "2.0.3"}}]}, "published": "2025-10-24T09:15:44.367", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L411"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L418"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/indieauth/tags/4.5.4/includes/class-indieauth-authorization-endpoint.php#L476"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3384558/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:07:52.781398+00:00", "value": {"mitigation_remediation": ["Install the latest IndieAuth plugin version (\u22654.5.5) to eliminate the CSRF flaw.", "If an immediate upgrade is not possible, block or restrict the wp-login.php?action=indieauth endpoint to known clients or use a firewall rule to prevent unauthenticated CSRF requests.", "Enable multi\u2011factor authentication for all WordPress accounts to add a second layer of protection."], "summary": {"action": "Immediate Patch", "impact": "Account Takeover via OAuth Token"}, "threat_synthesis": {"affected_systems": "Vendors affected are indieweb:IndieAuth. All releases of the IndieAuth plugin for WordPress up to and including version 4.5.4 are impacted. WordPress sites running any of these plugin versions are at risk, regardless of the site\u2019s WordPress core version.", "description_and_impact": "The IndieAuth WordPress plugin is vulnerable to Cross\u2011Site Request Forgery due to missing nonce verification in the login_form_indieauth() function and the authorization endpoint. Unauthenticated attackers can force a logged\u2011in user to approve OAuth requests for attacker\u2011controlled applications. Once the victim authorises, the attacker can exchange the obtained authorization code for an access token and gain full control of the victim's account with scopes that allow creating, updating, and deleting content. The vulnerability is a classic example of authentication bypass leading to account takeover.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the current landscape, but the fact that it is not listed in CISA\u2019s KEV catalog does not diminish the need for a quick response. Exploitation requires only social engineering to lure the target user to a crafted link or page while they are logged in; the attacker does not need site credentials. Once the forged request is processed, the attacker receives an access token and effectively takes over the user\u2019s account. Because the scope of the token can include full CRUD rights, the impact can be destructive to site content."}}}}, "created": "2025-10-27T22:13:17.481950+00:00", "updated": "2026-04-22T12:15:16.048016+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}