CVE-2025-13924: 
WordPress vulnerability analysis and mitigation

CVE-2025-13924 is a Cross-Site Request Forgery (CSRF) vulnerability in the Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin, affecting all versions up to and including 1.6.17. The flaw allows unauthenticated attackers to duplicate and publish product field groups — including draft and pending ones — by tricking a site administrator into clicking a malicious link. It was published on December 9, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing or incorrect nonce validation in the maybe_duplicate() function within class-admin-controller.php (lines 130–133). When the admin panel's main list screen is loaded, setup_screen() calls maybe_duplicate() unconditionally if the wapf_duplicate GET parameter is present, without verifying a WordPress nonce to confirm the request's legitimacy. An attacker can craft a URL such as https://target.com/wp-admin/admin.php?page=wapf-field-groups&wapf_duplicate=<post_id> and embed it in a page or email to lure an authenticated administrator into triggering the duplication and publication of any field group, including non-public drafts (GitHub Source, Wordfence).

Successful exploitation results in unauthorized modification of WooCommerce store content — specifically, draft or pending product field groups can be duplicated and published without the administrator's intent, compromising product data integrity. While there is no direct confidentiality or availability impact (CVSS C:N/A:N), the integrity impact includes unintended exposure of unpublished field configurations to customers. This could disrupt store operations or reveal incomplete/sensitive product configurations prematurely (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering — an unauthenticated attacker must trick a logged-in administrator into clicking a crafted link, limiting the practical attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Advanced Product Fields (Product Addons) for WooCommerce plugin at version 1.6.17 or earlier (e.g., via WPScan or by checking plugin metadata in publicly accessible readme files).
2. Identify target field group: Optionally enumerate existing draft or pending product field group post IDs on the target site (e.g., by observing URL patterns in admin links if accessible, or through other information disclosure).
3. Craft malicious URL: Construct a forged GET request URL targeting the vulnerable endpoint: https://target-site.com/wp-admin/admin.php?page=wapf-field-groups&wapf_duplicate=<post_id>, where <post_id> is the ID of the field group to duplicate and publish.
4. Social engineering delivery: Embed the crafted URL in a phishing email, forum post, or malicious web page designed to be visited by a site administrator while they are authenticated to the WordPress backend.
5. Trigger CSRF: When the administrator clicks the link or loads the page containing the forged request, the maybe_duplicate() function executes without nonce verification, duplicating the target field group and publishing it with status publish.
6. Outcome: The previously draft or pending field group is now publicly visible on the WooCommerce store, potentially exposing unfinished or sensitive product field configurations to customers (GitHub Source, Wordfence).

• Logs: WordPress access logs showing GET requests to /wp-admin/admin.php?page=wapf-field-groups&wapf_duplicate=<id> from unexpected referrers or external origins; repeated requests with varying wapf_duplicate values may indicate enumeration.
• Database/Content: Unexpected new published posts of the wapf_product custom post type (or equivalent) with titles containing " - Copy" appended, especially if corresponding to previously draft or pending field groups.
• WordPress Admin: Newly published product field groups appearing in the WooCommerce Product Input Fields admin list that administrators do not recall creating or publishing.

The vulnerability is fixed in version 1.6.18 of the Advanced Product Fields (Product Addons) for WooCommerce plugin, which introduces proper nonce validation in the maybe_duplicate() function. Site administrators should update the plugin to 1.6.18 or later immediately via the WordPress plugin dashboard. As a temporary workaround prior to patching, administrators can restrict access to the WordPress admin panel to trusted IP addresses or disable the plugin until the update is applied (Wordfence, WordPress Changeset).