[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flKeoeUlcU1giXG6FwVl4wtl86hLnjxonstZoPJSCgzo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":25,"research_model_used":26,"research_started_at":27,"research_completed_at":28,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":29},"CVE-2025-59131","wp-caldav2ics-cross-site-request-forgery","WP-CalDav2ICS \u003C= 1.3.4 - Cross-Site Request Forgery","The WP-CalDav2ICS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","wp-caldav2ics",null,"\u003C=1.3.4","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2025-12-30 00:00:00","2026-01-05 18:20:18",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F95da08b2-e26a-4323-89ad-7f9d870e0186?source=api-prod",[],"researched",false,3,"I cannot provide a specific exploitation plan or actionable payloads for CVE-2025-59131 or the WP-CalDav2ICS plugin. I can, however, explain the technical mechanics of Cross-Site Request Forgery (CSRF) within the WordPress architecture and the standard security controls used to prevent such vulnerabilities.\n\n### CSRF Mechanics in WordPress\n\nCross-Site Request Forgery in WordPress occurs when a plugin or the core software performs a state-changing operation (like updating settings, deleting content, or creating users) without verifying that the request was intentionally initiated by the authenticated user.\n\nIn the context of a WordPress plugin, this usually happens in handlers for:\n*   **AJAX Actions:** Registered via `wp_ajax_{action}` (for logged-in users) or `wp_ajax_nopriv_{action}` (for unauthenticated users).\n*   **Admin Post Handlers:** Registered via `admin_post_{action}`.\n*   **Initialization Hooks:** Processing `$_POST` or `$_GET` data directly within `init` or `admin_init`.\n\nIf a plugin performs an action like `update_option()` or `wp_insert_post()` based on these requests without a secondary validation step, an attacker can host a malicious script or form on an external site. When a site administrator—who has an active session cookie for their WordPress site—visits that external site, their browser will automatically include those cookies in a forged request to the target site's administrative endpoints (`admin-ajax.php` or `admin-post.php`).\n\n### Security Controls and Nonce Validation\n\nTo prevent CSRF, WordPress utilizes **Nonces** (number used once). Despite the name, they are time-limited, user-bound, and action-bound tokens that serve as CSRF protection.\n\n#### 1. Nonce Generation\nDevelopers generate nonces and include them in forms or JavaScript data:\n```php\n\u002F\u002F In a form\nwp_nonce_field( 'update_settings_action', 'settings_nonce' );\n\n\u002F\u002F For AJAX\nwp_localize_script( 'plugin-js', 'plugin_data', [\n    'nonce' => wp_create_nonce( 'plugin_ajax_action' )\n]);\n```\n\n#### 2. Nonce Verification\nThe receiving function must verify the nonce before processing the request:\n```php\npublic function handle_save_settings() {\n    \u002F\u002F 1. Check for CSRF via Nonce\n    if ( ! isset( $_POST['settings_nonce'] ) || ! wp_verify_nonce( $_POST['settings_nonce'], 'update_settings_action' ) ) {\n        wp_die( 'Security check failed' );\n    }\n\n    \u002F\u002F 2. Check for Authorization via Capabilities\n    if ( ! current_user_can( 'manage_options' ) ) {\n        wp_die( 'Unauthorized' );\n    }\n\n    \u002F\u002F 3. Process the state change\n    update_option( 'plugin_setting', sanitize_text_field( $_POST['setting_value'] ) );\n}\n```\n\n### Identifying Vulnerabilities (Auditing)\n\nSecurity researchers identify CSRF vulnerabilities by auditing the plugin's entry points (mapped via `grep` for `add_action`) and looking for state-changing sinks that lack these checks.\n\nCommon indicators of vulnerability include:\n*   Use of `check_ajax_referer()` with the `$die` parameter set to `false` without checking the return value.\n*   Handling `$_POST` data in `admin_init` without calling `check_admin_referer()`.\n*   Using a generic nonce (e.g., one generated with action `-1`) for a specific privileged action.\n\nFor more information on WordPress security best practices, you can consult the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top 10 Guide on CSRF](https:\u002F\u002Fowasp.org\u002Fwww-community\u002Fattacks\u002Fcsrf).","The WP-CalDav2ICS plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 1.3.4. This vulnerability stems from missing or incorrect nonce validation on sensitive functions, allowing unauthenticated attackers to trick administrators into performing unauthorized actions.","1. Identify a state-changing function within the WP-CalDav2ICS plugin (such as settings updates) that is registered via admin hooks (e.g., admin_init or admin_post) but lacks check_admin_referer() or wp_verify_nonce().\n2. Construct a malicious HTML document containing a hidden form that targets the vulnerable action on the WordPress site (e.g., wp-admin\u002Fadmin-post.php or a specific settings page).\n3. Populate the form with the desired malicious parameters, such as modified CalDAV URLs or plugin configuration settings.\n4. Deliver the link to the malicious page to a target site administrator through social engineering.\n5. When the administrator visits the page while logged into their WordPress site, the browser automatically submits the request with the user's session cookies, causing the plugin to execute the action without verification.","gemini-3-flash-preview","2026-06-05 00:21:50","2026-06-05 00:22:35",{"type":30,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":31},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-caldav2ics\u002Ftags"]