CVE-2025-13521: 
WordPress vulnerability analysis and mitigation

CVE-2025-13521 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Status Notifier plugin for WordPress, affecting all versions up to and including 1.0. The flaw stems from missing or incorrect nonce validation on the plugin's settings update functionality, allowing unauthenticated attackers to modify plugin settings by tricking an authenticated administrator into clicking a malicious link. It was published on January 7, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), arising from the absence of proper nonce validation in the plugin's options-page.php file, which handles settings updates. Because the settings endpoint does not verify that requests originate from a legitimate, authenticated session, an attacker can craft a forged HTTP request that, when triggered by an administrator's browser, will be processed as a valid settings change. Exploitation requires social engineering — the attacker must trick a logged-in WordPress administrator into visiting a malicious page or clicking a crafted link. The vulnerable code is visible in the plugin's source at options-page.php#L2 (WordPress Plugin Trac, Wordfence).

Successful exploitation allows an unauthenticated attacker to modify the WP Status Notifier plugin's settings on a vulnerable WordPress site, potentially disrupting notification workflows or injecting malicious configuration values. The impact is limited to integrity — there is no direct confidentiality or availability impact — and is constrained to the plugin's settings scope. However, depending on what the plugin controls (e.g., notification endpoints or email addresses), altered settings could facilitate further abuse such as redirecting status notifications to attacker-controlled addresses (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13521. The EPSS score is extremely low at approximately 0.012%, reflecting minimal likelihood of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (an administrator must be tricked into triggering the forged request), which significantly limits its practical exploitability (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Status Notifier plugin (version ≤ 1.0) by scanning for the plugin's presence via common WordPress enumeration techniques (e.g., checking /wp-content/plugins/wp-change-status-notifier/).
2. Craft forged request: Create an HTML page or link containing a hidden form that submits a POST request to the target WordPress site's plugin settings endpoint (the options-page.php handler), with attacker-controlled settings values and no valid nonce.
3. Social engineering: Deliver the malicious link or page to a WordPress site administrator via phishing email, forum post, or other means, inducing them to click it while authenticated to their WordPress dashboard.
4. Settings modification: When the administrator's browser loads the attacker's page, the forged form auto-submits, and the server processes the request as a legitimate settings update — overwriting plugin configuration with attacker-supplied values (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to the plugin's settings page (/wp-admin/options-general.php?page=wp-change-status-notifier or similar) from unusual referrers or external origins.
• File System: Unexpected changes to the plugin's stored settings in the WordPress database (wp_options table), particularly modifications to WP Status Notifier configuration entries at unusual times.
• Network: Outbound notification traffic directed to unfamiliar or attacker-controlled email addresses or endpoints following a settings change.

WordPress site administrators should check whether a patched version of the WP Status Notifier plugin (beyond version 1.0) is available in the WordPress plugin repository and update immediately if so. If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fixed version is released. General hardening measures include using a Web Application Firewall (WAF) with CSRF protection rules — Wordfence users with the premium firewall may receive rule-based protection (Wordfence).