CVE-2025-13408: 
WordPress vulnerability analysis and mitigation

CVE-2025-13408 is a Cross-Site Request Forgery (CSRF) vulnerability in the Foxtool All-in-One WordPress plugin (Contact chat button, Custom login, Media optimize images). It affects all versions up to and including 2.5.2, and was disclosed on December 12, 2025. The flaw allows unauthenticated attackers to establish an unauthorized OAuth connection by tricking a site administrator into clicking a malicious link. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is missing or incorrect nonce validation on the foxtool_login_google() function (CWE-352: Cross-Site Request Forgery). Because WordPress nonces are not properly verified before processing OAuth connection requests, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the site to establish an OAuth connection under attacker-controlled parameters. Exploitation requires social engineering — the attacker must trick an administrator into clicking a crafted link or visiting a malicious page that submits the forged request. The vulnerable code path is visible in the plugin's inc/goo.php file (Wordfence, WordPress SVN).

Successful exploitation allows an unauthenticated attacker to establish an unauthorized OAuth connection on the affected WordPress site, potentially linking the site's authentication flow to an attacker-controlled OAuth provider. This primarily affects site integrity — there is no direct confidentiality or availability impact per the CVSS assessment. However, a compromised OAuth connection could facilitate account takeover or unauthorized access to site resources depending on how the OAuth integration is subsequently used (Red Hat CVE, Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.012%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator must be tricked into clicking a malicious link), which limits its practical exploitability (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Foxtool All-in-One plugin version ≤ 2.5.2 using tools like WPScan or by checking publicly accessible plugin metadata.
2. Craft forged request: Construct a malicious HTML page or URL that submits a POST request to the target WordPress site's endpoint invoking foxtool_login_google(), including attacker-controlled OAuth parameters.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other means, inducing them to click it while authenticated to their WordPress dashboard.
4. OAuth connection established: When the administrator's browser executes the forged request, the missing nonce validation allows the server to process it, establishing an OAuth connection with attacker-controlled credentials.
5. Leverage access: Depending on the OAuth provider configuration, the attacker may be able to use the established connection to influence login behavior or gain unauthorized access to site functionality (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to endpoints associated with foxtool_login_google() or Google OAuth callback URLs originating from unusual referrers or IP addresses.
• Application: Unexpected or unrecognized OAuth connections configured in the Foxtool plugin settings within the WordPress admin panel.
• Network: Outbound OAuth authorization requests to Google APIs initiated without a corresponding administrator action in the WordPress dashboard.

The vendor (Foxtheme) released a patched version 2.5.3 of the Foxtool All-in-One plugin that addresses the missing nonce validation. Site administrators should update the plugin to version 2.5.3 or later immediately via the WordPress plugin dashboard. As a temporary workaround, disabling the Foxtool plugin's Google OAuth/login functionality or deactivating the plugin entirely will eliminate the attack surface until patching is feasible (Wordfence, WordPress Plugin Page).

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the advisory on December 12, 2025. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified for this medium-severity plugin vulnerability (Wordfence).