CVE-2025-13629: 
WordPress vulnerability analysis and mitigation

CVE-2025-13629 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Landing Page plugin for WordPress, affecting all versions up to and including 0.9.3. The flaw stems from missing nonce validation on the wplp_api_update_text function, enabling unauthenticated attackers to update arbitrary post meta by tricking a site administrator into clicking a malicious link. It was published on December 6, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), specifically the absence of WordPress nonce validation in the wplp_api_update_text function within includes/wplp-api.php. Because no nonce is checked, any forged HTTP request that originates from an authenticated administrator's browser session can invoke this function and modify arbitrary post metadata. Exploitation requires social engineering — the attacker must lure a logged-in site administrator into triggering the forged request, for example by clicking a crafted link or visiting a malicious page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to update arbitrary post meta on the WordPress site, enabling manipulation of landing page content and potentially injecting malicious data into page metadata. The impact is limited to integrity — there is no direct confidentiality or availability impact. While the vulnerability does not grant remote code execution on its own, tampered post meta could be leveraged to deface landing pages or set up further attacks against site visitors (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13629. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction from a privileged user, which significantly limits its practical attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Landing Page plugin at version 0.9.3 or earlier, using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Craft forged request: Construct a malicious HTML page or URL that, when loaded by a browser, sends a POST request to the target WordPress site's AJAX endpoint invoking wplp_api_update_text with attacker-controlled post meta key/value pairs.
3. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, forum post, or other channel, inducing them to click the link while authenticated to their WordPress dashboard.
4. Post meta modification: The administrator's browser automatically includes their session cookies with the forged request; since no nonce is validated, the server processes the request and updates the targeted post meta with attacker-supplied values.
5. Objective achieved: The attacker's chosen post metadata is written to the database, potentially altering landing page content or injecting data for further exploitation (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to the AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter corresponding to wplp_api_update_text, especially from unusual referrer origins or at unexpected times.
• Database: Unexpected or unauthorized changes to post meta values in the wp_postmeta table associated with landing page posts, particularly entries modified without a corresponding administrator action.
• Network: HTTP POST requests to /wp-admin/admin-ajax.php originating from external or unfamiliar IP addresses with referrer headers pointing to non-site domains.

Users should update the WP Landing Page plugin to version 0.9.4 or later, which addresses the missing nonce validation in the wplp_api_update_text function. No configuration-based workaround is available for the vulnerable versions; upgrading is the only reliable remediation. Site administrators should also review recent post meta changes for unauthorized modifications and exercise caution when clicking links from untrusted sources while logged into WordPress (Wordfence).